[Oisf-users] Error: luastate pool init failed

[Peter Manev]

On Mon, Jan 18, 2016 at 12:47 PM, Kevin Ross <kevross33 at googlemail.com> wrote:
> I don't get the original error yes. The stuff about not be able to alloc and
> luajit keyword issues disappears.
>
> The thing is now as it goes through all the luajit rules it fails to parse
> them and then provides the error that it failed to load any rules from
> luajit.rules although this is a non-fatal error but still means luajit rules
> aren't working.

This err ?
(detect-lua.c:221) <Error> (DetectLuajitSetupStatesPool) -- [ERRCODE:
SC_ERR_LUA_ERROR(212)] - luastate pool init failed, lua/luajit
keywords won't work



>
> Thanks.
>
> On 18 January 2016 at 11:43, Peter Manev <petermanev at gmail.com> wrote:
>>
>> On Mon, Jan 18, 2016 at 12:37 PM, Kevin Ross <kevross33 at googlemail.com>
>> wrote:
>> > These, the ones you suggested resulted in the same error. Found some
>> > other
>> > info here so tried some of the various settings
>> >
>> > http://pevma.blogspot.co.uk/2014/08/suricata-flows-flow-managers-and-effect.html.
>> > Not ideal as I think prealloc is set very high. The thing is the link
>> > itself
>> > this box is monitoring is 100Mbs and typically does less that this and
>> > the
>> > box itself has 32 cores and 128GB RAM.
>> >
>> > flow:
>> >   memcap: 4gb
>> >   hash-size: 65534
>> >   prealloc: 8000000
>> >   emergency-recovery: 30
>> >   #managers: 1 # default to one flow manager
>> >   #recyclers: 1 # default to one flow recycler thread
>> >
>>
>> So with the above flow settings - you dont get the err - am I
>> understanding this correctly?
>>
>>
>> > On 18 January 2016 at 11:06, Peter Manev <petermanev at gmail.com> wrote:
>> >>
>> >> On Mon, Jan 18, 2016 at 12:00 PM, Kevin Ross <kevross33 at googlemail.com>
>> >> wrote:
>> >> > Changing it to that puts it back to having the alloc errors. Also it
>> >> > seems
>> >> > now with this messing around I am getting engine initialization
>> >> > errors
>> >> > so
>> >> > need to have a peek at those.
>> >> >
>> >>
>> >> Ok. I didnt understand  - which settings work for your set up?
>> >>
>> >>
>> >> > On 18 January 2016 at 10:50, Peter Manev <petermanev at gmail.com>
>> >> > wrote:
>> >> >>
>> >> >> On Mon, Jan 18, 2016 at 11:43 AM, Kevin Ross
>> >> >> <kevross33 at googlemail.com>
>> >> >> wrote:
>> >> >> > Actually increasing it significantly higher seems to have resolved
>> >> >> > those
>> >> >> > error messages:
>> >> >> >
>> >> >> > flow:
>> >> >> >   memcap: 4gb
>> >> >> >   hash-size: 15728640
>> >> >> >   prealloc: 8000000
>> >> >> >   emergency-recovery: 30
>> >> >> >   #managers: 1 # default to one flow manager
>> >> >> >   #recyclers: 1 # default to one flow recycler thread
>> >> >> >
>> >> >>
>> >> >> Can you try with
>> >> >>   hash-size: 65534
>> >> >>   prealloc: 20000
>> >> >>
>> >> >> and see if any diff ?
>> >> >>
>> >> >> > However now it is failing to actually parse any signatures from
>> >> >> > luajit.rules
>> >> >> >
>> >> >> > On 18 January 2016 at 10:35, Kevin Ross <kevross33 at googlemail.com>
>> >> >> > wrote:
>> >> >> >>
>> >> >> >> Hi,
>> >> >> >>
>> >> >> >> yes I found that during initial troubleshooting and checking
>> >> >> >> internet
>> >> >> >> for
>> >> >> >> same issues. It seems to be the same but changing these values
>> >> >> >> have
>> >> >> >> not
>> >> >> >> resolved this for me:
>> >> >> >>
>> >> >> >> [16087] 18/1/2016 -- 10:33:02 - (util-pool.c:169) <Error>
>> >> >> >> (PoolInit)
>> >> >> >> --
>> >> >> >> [ERRCODE: SC_ERR_POOL_INIT(66)] - alloc error
>> >> >> >> [16087] 18/1/2016 -- 10:33:03 - (detect-lua.c:221) <Error>
>> >> >> >> (DetectLuajitSetupStatesPool) -- [ERRCODE: SC_ERR_LUA_ERROR(212)]
>> >> >> >> -
>> >> >> >> luastate
>> >> >> >> pool init failed, lua/luajit keywords won't work
>> >> >> >>
>> >> >> >> I have raised the memcaps to 1gb and the prealloc to 20,000 and
>> >> >> >> then
>> >> >> >> 40,000 to see if that helps but I still get the same issue.
>> >> >> >>
>> >> >> >>
>> >> >> >> On 18 January 2016 at 10:20, Peter Manev <petermanev at gmail.com>
>> >> >> >> wrote:
>> >> >> >>>
>> >> >> >>> On Mon, Jan 18, 2016 at 11:14 AM, Kevin Ross
>> >> >> >>> <kevross33 at googlemail.com>
>> >> >> >>> wrote:
>> >> >> >>> >
>> >> >> >>> > Hi,
>> >> >> >>> >
>> >> >> >>> > On a relatively new build what causes this error which is
>> >> >> >>> > preventing
>> >> >> >>> > luajit rules from working? I get this error which seems to be
>> >> >> >>> > the
>> >> >> >>> > base issue
>> >> >> >>> > before all the rule errors and luajit detect errors then
>> >> >> >>> > occur:
>> >> >> >>> >
>> >> >> >>> > (detect-lua.c:221) <Error> (DetectLuajitSetupStatesPool) --
>> >> >> >>> > [ERRCODE:
>> >> >> >>> > SC_ERR_LUA_ERROR(212)] - luastate pool init failed, lua/luajit
>> >> >> >>> > keywords
>> >> >> >>> > won't work
>> >> >> >>> >
>> >> >> >>> > The compile however goes ok for luajit:
>> >> >> >>> >
>> >> >> >>> >
>> >> >> >>> >
>> >> >> >>> > The system is running on Centos 7 with latest Suciricata Dev
>> >> >> >>> > version
>> >> >> >>> > currently (as I upgraded to try and see if that fixes it and
>> >> >> >>> > also
>> >> >> >>> > because I
>> >> >> >>> > use forward proxy stuff). This runs in IDS mode only.
>> >> >> >>> >
>> >> >> >>>
>> >> >> >>> Hi
>> >> >> >>>
>> >> >> >>> Similar to this -
>> >> >> >>> https://redmine.openinfosecfoundation.org/issues/1611
>> >> >> >>> ?
>> >> >> >>>
>> >> >> >>> Can you try to see if adjusting the memcaps and prealloc will
>> >> >> >>> work
>> >> >> >>> for
>> >> >> >>> you ?
>> >> >> >>>
>> >> >> >>> Thanks
>> >> >> >>>
>> >> >> >>> >
>> >> >> >>> > Kind Regards,
>> >> >> >>> > Kevin Ross
>> >> >> >>> >
>> >> >> >>> > _______________________________________________
>> >> >> >>> > Suricata IDS Users mailing list:
>> >> >> >>> > oisf-users at openinfosecfoundation.org
>> >> >> >>> > Site: http://suricata-ids.org | Support:
>> >> >> >>> > http://suricata-ids.org/support/
>> >> >> >>> > List:
>> >> >> >>> >
>> >> >> >>> >
>> >> >> >>> > https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users
>> >> >> >>> > Suricata User Conference November 4 & 5 in Barcelona:
>> >> >> >>> > http://oisfevents.net
>> >> >> >>>
>> >> >> >>>
>> >> >> >>>
>> >> >> >>>
>> >> >> >>> --
>> >> >> >>> Regards,
>> >> >> >>> Peter Manev
>> >> >> >>
>> >> >> >>
>> >> >> >
>> >> >>
>> >> >>
>> >> >>
>> >> >> --
>> >> >> Regards,
>> >> >> Peter Manev
>> >> >
>> >> >
>> >>
>> >>
>> >>
>> >> --
>> >> Regards,
>> >> Peter Manev
>> >
>> >
>>
>>
>>
>> --
>> Regards,
>> Peter Manev
>
>



-- 
Regards,
Peter Manev