[Oisf-users] [8778] 7/4/2019 -- 14:26:53 - (tm-threads.c:1527) <Warning> (TmThreadDrainPacketThreads) -- [ERRCODE: SC_ERR_SHUTDOWN(188)] - unable to get all packet threads to process their packets in time
Ma Allen
mazhh at outlook.com
Sun Apr 7 06:52:48 UTC 2019
Hi everybody,
I'm writing protocol detection & parser for IMAP atop of Suricata 5.0.0-dev cloned from GitHub and encountered the problem as follows:
[8778] 7/4/2019 -- 14:26:53 - (tm-threads.c:1527) <Warning> (TmThreadDrainPacketThreads) -- [ERRCODE: SC_ERR_SHUTDOWN(188)] - unable to get all packet threads to process their packets in time
I use CentOS 7.0 VM in VMWare to run Suricata and assigned 2 processor cores + 2GB RAM to it.
While I met the problem, top command shows that the CPU usage is almost full. And I wonder that if I assigned the necessary computing resources to the VM. However, previous POP3 extension works well under the same environment.
top - 14:28:26 up 5:36, 3 users, load average: 4.06, 1.84, 0.73
Tasks: 372 total, 2 running, 370 sleeping, 0 stopped, 0 zombie
%Cpu(s): 99.8 us, 0.2 sy, 0.0 ni, 0.0 id, 0.0 wa, 0.0 hi, 0.0 si, 0.0 st
KiB Mem : 1868688 total, 677668 free, 445832 used, 745188 buff/cache
KiB Swap: 2097148 total, 2097148 free, 0 used. 1247408 avail Mem
PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND
8778 root 20 0 792656 273396 4968 S 199.0 14.6 5:11.97 Suricata-Main
354 root 20 0 0 0 0 S 0.3 0.0 0:20.79 kworker/0:3
8786 coapk 20 0 146472 2348 1456 R 0.3 0.1 0:00.34 top
1 root 20 0 41344 3700 2408 S 0.0 0.2 0:02.45 systemd
2 root 20 0 0 0 0 S 0.0 0.0 0:00.04 kthreadd
3 root 20 0 0 0 0 S 0.0 0.0 0:00.26 ksoftirqd/0
The whole log is attached below:
[coapk at localhost suricata]$ sudo suricata -c ~/suricata/suricata.yaml -r ~/pcap/imap/imap_aliyun_outlook_short.pcapng -k none --init-errors-fatal
[8778] 7/4/2019 -- 14:25:46 - (suricata.c:1085) <Notice> (LogVersion) -- This is Suricata version 5.0.0-dev (rev e710b06)
[8778] 7/4/2019 -- 14:25:46 - (app-layer-imap.c:748) <Notice> (RegisterImapParsers) -- Imap TCP protocol detection enabled.
[8778] 7/4/2019 -- 14:25:46 - (app-layer-imap.c:771) <Notice> (RegisterImapParsers) -- No imap app-layer configuration, enabling imap detection TCP detection on port 143.
[8778] 7/4/2019 -- 14:25:46 - (app-layer-imap.c:786) <Notice> (RegisterImapParsers) -- Registering Imap protocol parser.
[8778] 7/4/2019 -- 14:25:46 - (output-json-imap.c:179) <Notice> (JsonImapLogRegister) -- Imap JSON logger registered.
[8778] 7/4/2019 -- 14:25:47 - (output-json-imap.c:122) <Notice> (OutputImapLogInitSub) -- Imap log sub-module initialized.
[8778] 7/4/2019 -- 14:25:48 - (detect-flowbits.c:480) <Warning> (DetectFlowbitsAnalyze) -- [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit 'HTTP.UncompressedFlash' is checked but not set. Checked in 2016396 and 3 other sigs
[8778] 7/4/2019 -- 14:25:48 - (detect-flowbits.c:480) <Warning> (DetectFlowbitsAnalyze) -- [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit 'ET.pdf.in.http' is checked but not set. Checked in 2017150 and 5 other sigs
[8778] 7/4/2019 -- 14:25:48 - (detect-flowbits.c:480) <Warning> (DetectFlowbitsAnalyze) -- [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit 'ET.JS.Obfus.Func' is checked but not set. Checked in 2017246 and 1 other sigs
[8778] 7/4/2019 -- 14:25:48 - (detect-flowbits.c:480) <Warning> (DetectFlowbitsAnalyze) -- [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit 'et.http.PK' is checked but not set. Checked in 2019835 and 3 other sigs
[8778] 7/4/2019 -- 14:25:48 - (detect-flowbits.c:480) <Warning> (DetectFlowbitsAnalyze) -- [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit 'et.JavaArchiveOrClass' is checked but not set. Checked in 2017756 and 15 other sigs
[8778] 7/4/2019 -- 14:25:48 - (detect-flowbits.c:480) <Warning> (DetectFlowbitsAnalyze) -- [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit 'et.WinHttpRequest' is checked but not set. Checked in 2019822 and 1 other sigs
[8778] 7/4/2019 -- 14:25:48 - (detect-flowbits.c:480) <Warning> (DetectFlowbitsAnalyze) -- [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit 'ET.wininet.UA' is checked but not set. Checked in 2021312 and 0 other sigs
[8778] 7/4/2019 -- 14:25:48 - (detect-flowbits.c:480) <Warning> (DetectFlowbitsAnalyze) -- [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit 'et.MS.XMLHTTP.ip.request' is checked but not set. Checked in 2022050 and 1 other sigs
[8778] 7/4/2019 -- 14:25:48 - (detect-flowbits.c:480) <Warning> (DetectFlowbitsAnalyze) -- [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit 'et.MS.XMLHTTP.no.exe.request' is checked but not set. Checked in 2022053 and 0 other sigs
[8778] 7/4/2019 -- 14:25:48 - (detect-flowbits.c:480) <Warning> (DetectFlowbitsAnalyze) -- [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit 'et.MS.WinHttpRequest.no.exe.request' is checked but not set. Checked in 2022653 and 0 other sigs
[8778] 7/4/2019 -- 14:25:48 - (detect-flowbits.c:480) <Warning> (DetectFlowbitsAnalyze) -- [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit 'et.IE7.NoRef.NoCookie' is checked but not set. Checked in 2023671 and 11 other sigs
[8778] 7/4/2019 -- 14:25:48 - (detect-flowbits.c:480) <Warning> (DetectFlowbitsAnalyze) -- [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit 'et.MCOFF' is checked but not set. Checked in 2019837 and 1 other sigs
[8778] 7/4/2019 -- 14:25:48 - (detect-flowbits.c:480) <Warning> (DetectFlowbitsAnalyze) -- [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit 'min.gethttp' is checked but not set. Checked in 2023711 and 0 other sigs
[8778] 7/4/2019 -- 14:25:48 - (detect-flowbits.c:480) <Warning> (DetectFlowbitsAnalyze) -- [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit 'ET.armwget' is checked but not set. Checked in 2024241 and 1 other sigs
[8778] 7/4/2019 -- 14:25:52 - (tm-threads.c:2172) <Notice> (TmThreadWaitOnThreadInit) -- all 3 packet processing threads, 4 management threads initialized, engine started.
[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:279) <Notice> (ImapProbingParser) -- Detected as ALPROTO_IMAP.
[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:179) <Notice> (ImapStateAlloc) -- Allocating imap state.
[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice> (ImapGetTxCnt) -- Current tx count is 0.
[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:472) <Notice> (ImapParseRequest) -- Parsing imap request: input=00hi CAPABILITY
, len=17
[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice> (ImapGetTxCnt) -- Current tx count is 1.
[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice> (ImapGetTxCnt) -- Current tx count is 1.
[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice> (ImapGetTx) -- Requested tx ID 0.
[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70c276cb0.
[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice> (ImapGetTxCnt) -- Current tx count is 1.
[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice> (ImapGetTx) -- Requested tx ID 0.
[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70c276cb0.
[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice> (ImapGetTxCnt) -- Current tx count is 1.
[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice> (ImapGetTx) -- Requested tx ID 0.
[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70c276cb0.
[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice> (ImapGetTxCnt) -- Current tx count is 1.
[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice> (ImapGetTx) -- Requested tx ID 0.
[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70c276cb0.
[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice> (ImapGetTxCnt) -- Current tx count is 1.
[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice> (ImapGetTx) -- Requested tx ID 0.
[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70c276cb0.
[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice> (ImapGetTxCnt) -- Current tx count is 1.
[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice> (ImapGetTx) -- Requested tx ID 0.
[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70c276cb0.
[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice> (ImapGetTxCnt) -- Current tx count is 1.
[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice> (ImapGetTx) -- Requested tx ID 0.
[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70c276cb0.
[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice> (ImapGetTxCnt) -- Current tx count is 1.
[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice> (ImapGetTx) -- Requested tx ID 0.
[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70c276cb0.
[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice> (ImapGetTxCnt) -- Current tx count is 1.
[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:584) <Notice> (ImapParseResponse) -- Parsing imap response: input=* OK AliYun IMAP Server Ready(10.182.157.147)
* CAPABILITY IMAP4rev1 IDLE XLIST UIDPLUS ID SASL-IR AUTH=XOAUTH AUTH=EXTERNAL
00hi OK CAPABILITY completed
, len=157
[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice> (ImapGetTxCnt) -- Current tx count is 1.
[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice> (ImapGetTxCnt) -- Current tx count is 1.
[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice> (ImapGetTx) -- Requested tx ID 0.
[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70c276cb0.
[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice> (ImapGetTxCnt) -- Current tx count is 1.
[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice> (ImapGetTx) -- Requested tx ID 0.
[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70c276cb0.
[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice> (ImapGetTxCnt) -- Current tx count is 1.
[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice> (ImapGetTx) -- Requested tx ID 0.
[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70c276cb0.
[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice> (ImapGetTxCnt) -- Current tx count is 1.
[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice> (ImapGetTx) -- Requested tx ID 0.
[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70c276cb0.
[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice> (ImapGetTxCnt) -- Current tx count is 1.
[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice> (ImapGetTx) -- Requested tx ID 0.
[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70c276cb0.
[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice> (ImapGetTxCnt) -- Current tx count is 1.
[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice> (ImapGetTx) -- Requested tx ID 0.
[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70c276cb0.
[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice> (ImapGetTxCnt) -- Current tx count is 1.
[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice> (ImapGetTx) -- Requested tx ID 0.
[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70c276cb0.
[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice> (ImapGetTxCnt) -- Current tx count is 1.
[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice> (ImapGetTx) -- Requested tx ID 0.
[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70c276cb0.
[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice> (ImapGetTxCnt) -- Current tx count is 1.
[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:472) <Notice> (ImapParseRequest) -- Parsing imap request: input=p6hq LOGIN "xxx at yyy.com" "zzzzzz"
, len=40
[8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:535) <Notice> (ImapParseRequest) -- imap command login request, tx_id = 0
[8778] 7/4/2019 -- 14:25:52 - (suricata.c:2849) <Notice> (SuricataMainLoop) -- Signal Received. Stopping engine.
[8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:279) <Notice> (ImapProbingParser) -- Detected as ALPROTO_IMAP.
[8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:179) <Notice> (ImapStateAlloc) -- Allocating imap state.
[8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice> (ImapGetTxCnt) -- Current tx count is 0.
[8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:472) <Notice> (ImapParseRequest) -- Parsing imap request: input=61xu CAPABILITY
, len=17
[8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice> (ImapGetTxCnt) -- Current tx count is 1.
[8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice> (ImapGetTxCnt) -- Current tx count is 1.
[8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice> (ImapGetTx) -- Requested tx ID 0.
[8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70827e870.
[8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice> (ImapGetTxCnt) -- Current tx count is 1.
[8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice> (ImapGetTx) -- Requested tx ID 0.
[8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70827e870.
[8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice> (ImapGetTxCnt) -- Current tx count is 1.
[8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice> (ImapGetTx) -- Requested tx ID 0.
[8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70827e870.
[8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice> (ImapGetTxCnt) -- Current tx count is 1.
[8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice> (ImapGetTx) -- Requested tx ID 0.
[8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70827e870.
[8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice> (ImapGetTxCnt) -- Current tx count is 1.
[8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice> (ImapGetTx) -- Requested tx ID 0.
[8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70827e870.
[8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice> (ImapGetTxCnt) -- Current tx count is 1.
[8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice> (ImapGetTx) -- Requested tx ID 0.
[8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70827e870.
[8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice> (ImapGetTxCnt) -- Current tx count is 1.
[8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice> (ImapGetTx) -- Requested tx ID 0.
[8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70827e870.
[8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice> (ImapGetTxCnt) -- Current tx count is 1.
[8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice> (ImapGetTx) -- Requested tx ID 0.
[8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70827e870.
[8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice> (ImapGetTxCnt) -- Current tx count is 1.
[8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:584) <Notice> (ImapParseResponse) -- Parsing imap response: input=* OK AliYun IMAP Server Ready(10.182.157.147)
* CAPABILITY IMAP4rev1 IDLE XLIST UIDPLUS ID SASL-IR AUTH=XOAUTH AUTH=EXTERNAL
61xu OK CAPABILITY completed
, len=157
[8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice> (ImapGetTxCnt) -- Current tx count is 1.
[8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice> (ImapGetTxCnt) -- Current tx count is 1.
[8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice> (ImapGetTx) -- Requested tx ID 0.
[8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70827e870.
[8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice> (ImapGetTxCnt) -- Current tx count is 1.
[8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice> (ImapGetTx) -- Requested tx ID 0.
[8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70827e870.
[8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice> (ImapGetTxCnt) -- Current tx count is 1.
[8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice> (ImapGetTx) -- Requested tx ID 0.
[8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70827e870.
[8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice> (ImapGetTxCnt) -- Current tx count is 1.
[8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice> (ImapGetTx) -- Requested tx ID 0.
[8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70827e870.
[8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice> (ImapGetTxCnt) -- Current tx count is 1.
[8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:472) <Notice> (ImapParseRequest) -- Parsing imap request: input=ic9a LOGIN "xxx at yyy.com" "zzzzzz"
, len=40
[8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:535) <Notice> (ImapParseRequest) -- imap command login request, tx_id = 0
[8778] 7/4/2019 -- 14:26:53 - (tm-threads.c:1527) <Warning> (TmThreadDrainPacketThreads) -- [ERRCODE: SC_ERR_SHUTDOWN(188)] - unable to get all packet threads to process their packets in time
[coapk at localhost suricata]$ suricata --build-info
This is Suricata version 5.0.0-dev (rev e710b06)
Features: NFQ PCAP_SET_BUFF AF_PACKET HAVE_PACKET_FANOUT LIBCAP_NG LIBNET1.1 HAVE_HTP_URI_NORMALIZE_HOOK PCRE_JIT HAVE_NSS HAVE_LUA HAVE_LIBJANSSON TLS MAGIC RUST
SIMD support: SSE_4_2 SSE_4_1 SSE_3
Atomic intrisics: 1 2 4 8 16 byte(s)
64-bits, Little-endian architecture
GCC version 4.8.5 20150623 (Red Hat 4.8.5-36), C version 199901
compiled with _FORTIFY_SOURCE=0
L1 cache line size (CLS)=64
thread local storage method: __thread
compiled with LibHTP v0.5.28, linked against LibHTP v0.5.28
Suricata Configuration:
AF_PACKET support: yes
eBPF support: no
XDP support: no
PF_RING support: no
NFQueue support: yes
NFLOG support: no
IPFW support: no
Netmap support: no
DAG enabled: no
Napatech enabled: no
WinDivert enabled: no
Unix socket enabled: yes
Detection enabled: yes
Libmagic support: yes
libnss support: yes
libnspr support: yes
libjansson support: yes
liblzma support: no
hiredis support: no
hiredis async with libevent: no
Prelude support: no
PCRE jit: yes
LUA support: yes
libluajit: no
libgeoip: no
Non-bundled htp: no
Old barnyard2 support: no
Hyperscan support: no
Libnet support: yes
liblz4 support: no
Rust support: yes (default)
Rust strict mode: no
Rust debug mode: no
Rust compiler: rustc 1.32.0
Rust cargo: cargo 1.32.0
Install suricatasc: yes
Install suricata-update: no
Profiling enabled: no
Profiling locks enabled: no
Development settings:
Coccinelle / spatch: no
Unit tests enabled: no
Debug output enabled: no
Debug validation enabled: no
Generic build parameters:
Installation prefix: /usr
Configuration directory: /etc/suricata/
Log directory: /var/log/suricata/
--prefix /usr
--sysconfdir /etc
--localstatedir /var
--datarootdir /usr/share
Host: x86_64-unknown-linux-gnu
Compiler: gcc (exec name) / gcc (real)
GCC Protect enabled: no
GCC march native enabled: yes
GCC Profile enabled: no
Position Independent Executable enabled: no
CFLAGS -g -O2 -march=native -I${srcdir}/../rust/gen/c-headers
PCAP_CFLAGS
SECCFLAGS
Best Regards,
Allen Ma
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openinfosecfoundation.org/pipermail/oisf-users/attachments/20190407/dbeb4616/attachment-0001.html>
More information about the Oisf-users
mailing list