Project

General

Profile

Actions
Copy link

Bug #1539

closed
AT

Potential file handle leak

Bug #1539: Potential file handle leak

Added by Aboubacar Toure about 11 years ago. Updated over 10 years ago.

Status:
Closed
Priority:
Normal
Assignee:
-
Target version:
-
Affected Versions:
Effort:
Difficulty:
Label:

Description

We are running Suriata2.1beta4 (with lua rules) on Centos 6.6. Each time a live reload (kill -USR2 $pid) is performed, the number of file handles increases by about 200.
After the max file size for the process is reached, Suricata stops alerting but does not crash; and the following is logged:

...
[43126] 1/9/2015 -- 22:35:57 - (detect-lua.c:676) <Error> (DetectLuaThreadInit) -- [ERRCODE: SC_ERR_LUA_ERROR(212)] - couldn't load file: cannot open <file>.lua: Too many open files
[43126] 1/9/2015 -- 22:35:57 - (detect-engine.c:1236) <Error> (DetectEngineThreadCtxInitKeywords) -- [ERRCODE: SC_ERR_DETECT_PREPARE(173)] - setting up thread local detect ctx for keyword "luajit" failed
...
[43129] 1/9/2015 -- 22:36:17 - (respond-reject-libnet11.c:95) <Error> (RejectSendLibnet11L3IPv4TCP) -- [ERRCODE: SC_ERR_LIBNET_INIT(144)] - libnet_init failed: libnet_open_raw4(): SOCK_RAW allocation failed: Too many open files
...

AT Updated by Aboubacar Toure about 11 years ago Actions
Copy link
 #1

Aboubacar Toure wrote:

We are running Suriata2.1beta4 (with lua rules) on Centos 6.6. Each time a live reload "kill - USR2 $pid" is performed, the number of file handles increases by about 200.
After the max file size for the process is reached, Suricata stops alerting but does not crash; and the following is logged:
...
[43126] 1/9/2015 -- 22:35:57 - (detect-lua.c:676) <Error> (DetectLuaThreadInit) -- [ERRCODE: SC_ERR_LUA_ERROR(212)] - couldn't load file: cannot open <file>.lua: Too many open files
[43126] 1/9/2015 -- 22:35:57 - (detect-engine.c:1236) <Error> (DetectEngineThreadCtxInitKeywords) -- [ERRCODE: SC_ERR_DETECT_PREPARE(173)] - setting up thread local detect ctx for keyword "luajit" failed
...
[43129] 1/9/2015 -- 22:36:17 - (respond-reject-libnet11.c:95) <Error> (RejectSendLibnet11L3IPv4TCP) -- [ERRCODE: SC_ERR_LIBNET_INIT(144)] - libnet_init failed: libnet_open_raw4(): SOCK_RAW allocation failed: Too many open files
...

VJ Updated by Victor Julien almost 11 years ago Actions
Copy link
 #2

  • Description updated (diff)
  • Status changed from New to Assigned
  • Assignee set to Victor Julien
  • Priority changed from High to Normal

VJ Updated by Victor Julien almost 11 years ago Actions
Copy link
 #3

  • Target version changed from 3.0RC1 to 70

VJ Updated by Victor Julien over 10 years ago Actions
Copy link
 #4

I can't reproduce this. What scripts are you using?

VJ Updated by Victor Julien over 10 years ago Actions
Copy link
 #5

  • Status changed from Assigned to Closed
  • Assignee deleted (Victor Julien)
  • Target version deleted (70)

Can't reproduce and reporter not responding.

Actions
Copy link

Also available in: PDF Atom