[Oisf-users] Error: luastate pool init failed

[Kevin Ross]

ok forget about last engine error. One of my PCAP reads had a path error
that I had repeated a few times before realizing. The high settings I set
resolves the alloc errors but basically it is failing to parse any luajit
rules now even though it is going through them ok and when I setup the
rules I checked that the correct packets and individual lua files were
tested against file types.

On 18 January 2016 at 10:50, Peter Manev <petermanev at gmail.com> wrote:

> On Mon, Jan 18, 2016 at 11:43 AM, Kevin Ross <kevross33 at googlemail.com>
> wrote:
> > Actually increasing it significantly higher seems to have resolved those
> > error messages:
> >
> > flow:
> >   memcap: 4gb
> >   hash-size: 15728640
> >   prealloc: 8000000
> >   emergency-recovery: 30
> >   #managers: 1 # default to one flow manager
> >   #recyclers: 1 # default to one flow recycler thread
> >
>
> Can you try with
>   hash-size: 65534
>   prealloc: 20000
>
> and see if any diff ?
>
> > However now it is failing to actually parse any signatures from
> luajit.rules
> >
> > On 18 January 2016 at 10:35, Kevin Ross <kevross33 at googlemail.com>
> wrote:
> >>
> >> Hi,
> >>
> >> yes I found that during initial troubleshooting and checking internet
> for
> >> same issues. It seems to be the same but changing these values have not
> >> resolved this for me:
> >>
> >> [16087] 18/1/2016 -- 10:33:02 - (util-pool.c:169) <Error> (PoolInit) --
> >> [ERRCODE: SC_ERR_POOL_INIT(66)] - alloc error
> >> [16087] 18/1/2016 -- 10:33:03 - (detect-lua.c:221) <Error>
> >> (DetectLuajitSetupStatesPool) -- [ERRCODE: SC_ERR_LUA_ERROR(212)] -
> luastate
> >> pool init failed, lua/luajit keywords won't work
> >>
> >> I have raised the memcaps to 1gb and the prealloc to 20,000 and then
> >> 40,000 to see if that helps but I still get the same issue.
> >>
> >>
> >> On 18 January 2016 at 10:20, Peter Manev <petermanev at gmail.com> wrote:
> >>>
> >>> On Mon, Jan 18, 2016 at 11:14 AM, Kevin Ross <kevross33 at googlemail.com
> >
> >>> wrote:
> >>> >
> >>> > Hi,
> >>> >
> >>> > On a relatively new build what causes this error which is preventing
> >>> > luajit rules from working? I get this error which seems to be the
> base issue
> >>> > before all the rule errors and luajit detect errors then occur:
> >>> >
> >>> > (detect-lua.c:221) <Error> (DetectLuajitSetupStatesPool) -- [ERRCODE:
> >>> > SC_ERR_LUA_ERROR(212)] - luastate pool init failed, lua/luajit
> keywords
> >>> > won't work
> >>> >
> >>> > The compile however goes ok for luajit:
> >>> >
> >>> >
> >>> >
> >>> > The system is running on Centos 7 with latest Suciricata Dev version
> >>> > currently (as I upgraded to try and see if that fixes it and also
> because I
> >>> > use forward proxy stuff). This runs in IDS mode only.
> >>> >
> >>>
> >>> Hi
> >>>
> >>> Similar to this -
> >>> https://redmine.openinfosecfoundation.org/issues/1611
> >>> ?
> >>>
> >>> Can you try to see if adjusting the memcaps and prealloc will work for
> >>> you ?
> >>>
> >>> Thanks
> >>>
> >>> >
> >>> > Kind Regards,
> >>> > Kevin Ross
> >>> >
> >>> > _______________________________________________
> >>> > Suricata IDS Users mailing list:
> oisf-users at openinfosecfoundation.org
> >>> > Site: http://suricata-ids.org | Support:
> >>> > http://suricata-ids.org/support/
> >>> > List:
> >>> > https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users
> >>> > Suricata User Conference November 4 & 5 in Barcelona:
> >>> > http://oisfevents.net
> >>>
> >>>
> >>>
> >>>
> >>> --
> >>> Regards,
> >>> Peter Manev
> >>
> >>
> >
>
>
>
> --
> Regards,
> Peter Manev
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openinfosecfoundation.org/pipermail/oisf-users/attachments/20160118/cc8fd6c8/attachment-0002.html>