[Oisf-users] meta-data crashes
Peter Manev
petermanev at gmail.com
Wed Dec 19 06:45:32 UTC 2018
On Tue, Dec 18, 2018 at 8:34 PM Jeremy A. Grove <jgrove at quadrantsec.com> wrote:
>
> Hi Peter,
>
> I wanted to touch base and update you on the results of the below issue. Correcting the libhtp linking seems to have solved the logging issue.
>
Thank you for the feedback!
> Regards,
>
> Jeremy Grove, SSCP
> Security Engineer
> Quadrant Information Security
> o: [ callto:(904)296-9100 | (904)296-9100 ] x100
> t: [ callto:(800) 538-9357 | (800) 538-9357 ] x100
> e: [ mailto:soc at quadrantsec.com | soc at quadrantsec.com ]
>
> Learn more= about our managed SIEM [ https://a.quadrantsec.com/3D%22https://quadrantsec.com/SaganMSSP%22 | people + product ]
>
> ----- Original Message -----
> From: "Jeremy A. Grove" <jgrove at quadrantsec.com>
> To: "Peter Manev" <petermanev at gmail.com>
> Cc: "oisf-users" <oisf-users at lists.openinfosecfoundation.org>
> Sent: Friday, November 30, 2018 10:30:31 AM
> Subject: Re: [Oisf-users] meta-data crashes
>
> Jeremy Grove, SSCP
> Security Engineer
> Quadrant Information Security
> o: [ callto:(904)296-9100 | (904)296-9100 ] x100
> t: [ callto:(800) 538-9357 | (800) 538-9357 ] x100
> e: [ mailto:soc at quadrantsec.com | soc at quadrantsec.com ]
>
> Learn more= about our managed SIEM [ https://a.quadrantsec.com/3D%22https://quadrantsec.com/SaganMSSP%22 | people + product ]
>
> ----- Original Message -----
> From: "Peter Manev" <petermanev at gmail.com>
> To: "Jeremy A. Grove" <jgrove at quadrantsec.com>
> Cc: "oisf-users" <oisf-users at lists.openinfosecfoundation.org>
> Sent: Thursday, November 29, 2018 4:49:36 PM
> Subject: Re: [Oisf-users] meta-data crashes
>
> > This is Suricata version 4.1.0 RELEASE
> > Features: PCAP_SET_BUFF AF_PACKET HAVE_PACKET_FANOUT LIBCAP_NG LIBNET1.1 HAVE_HTP_URI_NORMALIZE_HOOK PCRE_JIT HAVE_NSS HAVE_LIBJANSSON TLS MAGIC RUST
> > SIMD support: SSE_4_2 SSE_4_1 SSE_3
> > Atomic intrisics: 1 2 4 8 16 byte(s)
> > 64-bits, Little-endian architecture
> > GCC version 6.3.0 20170516, C version 199901
> > compiled with _FORTIFY_SOURCE=0
> > L1 cache line size (CLS)=64
> > thread local storage method: __thread
> > compiled with LibHTP v0.5.28, linked against LibHTP v0.5.25
> >
>
> This above seems a bit odd - "compiled with LibHTP v0.5.28, linked
> against LibHTP v0.5.25"
> 4.1.0 should go with LibHTP 0.5.28 all the way , not linked against 0.5.25
> Could you please update and redeploy and see if it makes a difference ?
>
> The install process was linking to existing version of Libhtp so I removed all versions and let the install process reinstall. I will let this run and monitor for the issue.
>
> This is Suricata version 4.1.0 RELEASE
> Features: PCAP_SET_BUFF AF_PACKET HAVE_PACKET_FANOUT LIBCAP_NG LIBNET1.1 HAVE_HTP_URI_NORMALIZE_HOOK PCRE_JIT HAVE_NSS HAVE_LIBJANSSON TLS MAGIC RUST
> SIMD support: SSE_4_2 SSE_4_1 SSE_3
> Atomic intrisics: 1 2 4 8 16 byte(s)
> 64-bits, Little-endian architecture
> GCC version 6.3.0 20170516, C version 199901
> compiled with _FORTIFY_SOURCE=0
> L1 cache line size (CLS)=64
> thread local storage method: __thread
> compiled with LibHTP v0.5.28, linked against LibHTP v0.5.28
>
>
>
> Is there anything specific to your set up in terms of how you have
> Suricata running - on a VM/docker/HW ? What speeds are you looking at
> ?
>
> We have this issue in a variety of environments with different speeds. I am focusing on the 2 below.
>
> Speeds and equipment per location:
>
> Location A:
> HP ProLiant DL160 Gen9
> Dual -- Intel(R) Xeon(R) CPU E5-2609 v4 @ 1.70GHz
> 32 GB Ram
>
> 5 1Gb Ethernet monitored port with high utilization on average.
>
> Location B:
> HP ProLiant DL380 Gen9
> Dual -- Intel(R) Xeon(R) CPU E5-2620 v3 @ 2.40GHz
> 32 GB Ram
>
> 2 10GB fiber and 1 1GB ethernet - one of the 10GB interfaces averages around 6GB per second.
>
> > Suricata Configuration:
> > AF_PACKET support: yes
> > eBPF support: no
> > XDP support: no
> > PF_RING support: no
> > NFQueue support: no
> > NFLOG support: no
> > IPFW support: no
> > Netmap support: no
> > DAG enabled: no
> > Napatech enabled: no
> > WinDivert enabled: no
> >
> > Unix socket enabled: yes
> > Detection enabled: yes
> >
> > Libmagic support: yes
> > libnss support: yes
> > libnspr support: yes
> > libjansson support: yes
> > liblzma support: no
> > hiredis support: no
> > hiredis async with libevent: no
> > Prelude support: no
> > PCRE jit: yes
> > LUA support: no
> > libluajit: no
> > libgeoip: no
> > Non-bundled htp: no
> > Old barnyard2 support: no
> > Hyperscan support: yes
> > Libnet support: yes
> > liblz4 support: yes
> >
> > Rust support: yes (default)
> > Rust strict mode: no
> > Rust debug mode: no
> > Rust compiler: rustc 1.30.0 (da5f414c2 2018-10-24)
> > Rust cargo: cargo 1.30.0 (36d96825d 2018-10-24)
> >
> > Suricatasc install: yes
> >
> > Profiling enabled: no
> > Profiling locks enabled: no
> >
> > Development settings:
> > Coccinelle / spatch: no
> > Unit tests enabled: no
> > Debug output enabled: no
> > Debug validation enabled: no
> >
> > Generic build parameters:
> > Installation prefix: /usr
> > Configuration directory: /etc/suricata/
> > Log directory: /var/log/suricata/
> >
> > --prefix /usr
> > --sysconfdir /etc
> > --localstatedir /var
> >
> > Host: x86_64-pc-linux-gnu
> > Compiler: gcc (exec name) / gcc (real)
> > GCC Protect enabled: no
> > GCC march native enabled: yes
> > GCC Profile enabled: no
> > Position Independent Executable enabled: no
> > CFLAGS -g -O2 -march=native -I${srcdir}/../rust/gen/c-headers
> > PCAP_CFLAGS -I/usr/include
> > SECCFLAGS
>
>
>
> --
> Regards,
> Peter Manev
--
Regards,
Peter Manev
More information about the Oisf-users
mailing list