[Oisf-users] Error: luastate pool init failed

[Peter Manev]

On Mon, Jan 18, 2016 at 11:43 AM, Kevin Ross <kevross33 at googlemail.com> wrote:
> Actually increasing it significantly higher seems to have resolved those
> error messages:
>
> flow:
>   memcap: 4gb
>   hash-size: 15728640
>   prealloc: 8000000
>   emergency-recovery: 30
>   #managers: 1 # default to one flow manager
>   #recyclers: 1 # default to one flow recycler thread
>

Can you try with
  hash-size: 65534
  prealloc: 20000

and see if any diff ?

> However now it is failing to actually parse any signatures from luajit.rules
>
> On 18 January 2016 at 10:35, Kevin Ross <kevross33 at googlemail.com> wrote:
>>
>> Hi,
>>
>> yes I found that during initial troubleshooting and checking internet for
>> same issues. It seems to be the same but changing these values have not
>> resolved this for me:
>>
>> [16087] 18/1/2016 -- 10:33:02 - (util-pool.c:169) <Error> (PoolInit) --
>> [ERRCODE: SC_ERR_POOL_INIT(66)] - alloc error
>> [16087] 18/1/2016 -- 10:33:03 - (detect-lua.c:221) <Error>
>> (DetectLuajitSetupStatesPool) -- [ERRCODE: SC_ERR_LUA_ERROR(212)] - luastate
>> pool init failed, lua/luajit keywords won't work
>>
>> I have raised the memcaps to 1gb and the prealloc to 20,000 and then
>> 40,000 to see if that helps but I still get the same issue.
>>
>>
>> On 18 January 2016 at 10:20, Peter Manev <petermanev at gmail.com> wrote:
>>>
>>> On Mon, Jan 18, 2016 at 11:14 AM, Kevin Ross <kevross33 at googlemail.com>
>>> wrote:
>>> >
>>> > Hi,
>>> >
>>> > On a relatively new build what causes this error which is preventing
>>> > luajit rules from working? I get this error which seems to be the base issue
>>> > before all the rule errors and luajit detect errors then occur:
>>> >
>>> > (detect-lua.c:221) <Error> (DetectLuajitSetupStatesPool) -- [ERRCODE:
>>> > SC_ERR_LUA_ERROR(212)] - luastate pool init failed, lua/luajit keywords
>>> > won't work
>>> >
>>> > The compile however goes ok for luajit:
>>> >
>>> >
>>> >
>>> > The system is running on Centos 7 with latest Suciricata Dev version
>>> > currently (as I upgraded to try and see if that fixes it and also because I
>>> > use forward proxy stuff). This runs in IDS mode only.
>>> >
>>>
>>> Hi
>>>
>>> Similar to this -
>>> https://redmine.openinfosecfoundation.org/issues/1611
>>> ?
>>>
>>> Can you try to see if adjusting the memcaps and prealloc will work for
>>> you ?
>>>
>>> Thanks
>>>
>>> >
>>> > Kind Regards,
>>> > Kevin Ross
>>> >
>>> > _______________________________________________
>>> > Suricata IDS Users mailing list: oisf-users at openinfosecfoundation.org
>>> > Site: http://suricata-ids.org | Support:
>>> > http://suricata-ids.org/support/
>>> > List:
>>> > https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users
>>> > Suricata User Conference November 4 & 5 in Barcelona:
>>> > http://oisfevents.net
>>>
>>>
>>>
>>>
>>> --
>>> Regards,
>>> Peter Manev
>>
>>
>



-- 
Regards,
Peter Manev