[Oisf-users] Suricata 2.0.7 fails to start

[Victor Julien]

On 03/03/2015 04:05 PM, Yasha Zislin wrote:
> I have downloaded the latest suricata and compiled it the same way as I
> have done before.
> Everything seems to be find until i try to start it.
> I get errors like these
> [ERRCODE: SC_ERR_POOL_INIT(66)] - alloc error
> 3/3/2015 -- 09:33:29 - <Error> - [ERRCODE: SC_ERR_POOL_INIT(66)] - pool
> grow failed
> 3/3/2015 -- 09:33:29 - <Info> - (RxPFReth219) Using PF_RING v.6.0.3,
> interface eth2, cluster-id 98
> 3/3/2015 -- 09:33:30 - <Error> - [ERRCODE: SC_ERR_POOL_INIT(66)] - alloc
> error
> 3/3/2015 -- 09:33:30 - <Error> - [ERRCODE: SC_ERR_POOL_INIT(66)] - pool
> grow failed
> 3/3/2015 -- 09:33:30 - <Info> - (RxPFReth220) Using PF_RING v.6.0.3,
> interface eth2, cluster-id 98
> 3/3/2015 -- 09:33:30 - <Error> - [ERRCODE: SC_ERR_POOL_INIT(66)] - alloc
> error
> 3/3/2015 -- 09:33:30 - <Error> - [ERRCODE: SC_ERR_POOL_INIT(66)] - pool
> grow failed
> 3/3/2015 -- 09:33:30 - <Info> - RunModeIdsPfringWorkers initialised
> 3/3/2015 -- 09:33:30 - <Error> - [ERRCODE: SC_ERR_THREAD_INIT(49)] -
> thread "RxPFReth218" closed on initialization.
> 3/3/2015 -- 09:33:30 - <Error> - [ERRCODE: SC_ERR_INITIALIZATION(45)] -
> Engine initialization failed, aborting...
> 
> I have two interfaces with 20 threads for each. I am using latest
> PF_RING (which I usually recompile as well).
> 
> These errors seem to be PF_RING related. Any ideas?

This seems to be related to the fix for issue 1318
(https://redmine.openinfosecfoundation.org/issues/1318). Could you try
lowering your stream.prealloc-sessions setting?

-- 
---------------------------------------------
Victor Julien
http://www.inliniac.net/
PGP: http://www.inliniac.net/victorjulien.asc
---------------------------------------------