[Oisf-users] Suricata 2.0.7 fails to start

[Yasha Zislin]

Victor,

Thanks for quick response. Yes, I've reduced stream.prealloc-sessions and Suricata was able to start up.

It seems to me that we this reduction, I can have bigger packet loss which I am trying to prevent.
It used to work just fine with previous versions. 

Also, how can I calculate the highest value that I can use?

Thanks.

> Date: Tue, 3 Mar 2015 16:08:21 +0100
> From: lists at inliniac.net
> To: oisf-users at lists.openinfosecfoundation.org
> Subject: Re: [Oisf-users] Suricata 2.0.7 fails to start
> 
> On 03/03/2015 04:05 PM, Yasha Zislin wrote:
> > I have downloaded the latest suricata and compiled it the same way as I
> > have done before.
> > Everything seems to be find until i try to start it.
> > I get errors like these
> > [ERRCODE: SC_ERR_POOL_INIT(66)] - alloc error
> > 3/3/2015 -- 09:33:29 - <Error> - [ERRCODE: SC_ERR_POOL_INIT(66)] - pool
> > grow failed
> > 3/3/2015 -- 09:33:29 - <Info> - (RxPFReth219) Using PF_RING v.6.0.3,
> > interface eth2, cluster-id 98
> > 3/3/2015 -- 09:33:30 - <Error> - [ERRCODE: SC_ERR_POOL_INIT(66)] - alloc
> > error
> > 3/3/2015 -- 09:33:30 - <Error> - [ERRCODE: SC_ERR_POOL_INIT(66)] - pool
> > grow failed
> > 3/3/2015 -- 09:33:30 - <Info> - (RxPFReth220) Using PF_RING v.6.0.3,
> > interface eth2, cluster-id 98
> > 3/3/2015 -- 09:33:30 - <Error> - [ERRCODE: SC_ERR_POOL_INIT(66)] - alloc
> > error
> > 3/3/2015 -- 09:33:30 - <Error> - [ERRCODE: SC_ERR_POOL_INIT(66)] - pool
> > grow failed
> > 3/3/2015 -- 09:33:30 - <Info> - RunModeIdsPfringWorkers initialised
> > 3/3/2015 -- 09:33:30 - <Error> - [ERRCODE: SC_ERR_THREAD_INIT(49)] -
> > thread "RxPFReth218" closed on initialization.
> > 3/3/2015 -- 09:33:30 - <Error> - [ERRCODE: SC_ERR_INITIALIZATION(45)] -
> > Engine initialization failed, aborting...
> > 
> > I have two interfaces with 20 threads for each. I am using latest
> > PF_RING (which I usually recompile as well).
> > 
> > These errors seem to be PF_RING related. Any ideas?
> 
> This seems to be related to the fix for issue 1318
> (https://redmine.openinfosecfoundation.org/issues/1318). Could you try
> lowering your stream.prealloc-sessions setting?
> 
> -- 
> ---------------------------------------------
> Victor Julien
> http://www.inliniac.net/
> PGP: http://www.inliniac.net/victorjulien.asc
> ---------------------------------------------
> 
> _______________________________________________
> Suricata IDS Users mailing list: oisf-users at openinfosecfoundation.org
> Site: http://suricata-ids.org | Support: http://suricata-ids.org/support/
> List: https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users
> Training now available: http://suricata-ids.org/training/
 		 	   		  
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openinfosecfoundation.org/pipermail/oisf-users/attachments/20150303/c7efdcd9/attachment-0002.html>