Suricata

From the build-info output I see that there is no debug enabled - hence most likely not so much useful information to chase the issue.
Since you mention this is reproducible - can you please recompile with -

     CFLAGS="-O0 -ggdb"  ./configure.........

Then the coredump would be very helpful.

Peter Manev wrote:

From the build-info output I see that there is no debug enabled - hence most likely not so much useful information to chase the issue.
Since you mention this is reproducible - can you please recompile with -
[...]

Then the coredump would be very helpful.

Thanks for the input, just reconfigured and compiled/linked again and restart suricata. See what happens coming days.
Host: x86_64-unknown-linux-gnu
Compiler: gcc (exec name) / gcc (real)
GCC Protect enabled: yes
GCC march native enabled: yes
GCC Profile enabled: no
Position Independent Executable enabled: no
CFLAGS -O0 -ggdb -march=native
PCAP_CFLAGS -I/usr/local/include
SECCFLAGS -fstack-protector -D_FORTIFY_SOURCE=2 -Wformat -Wformat-security

Any news for this issue? Haven't seen the same issue but very anxious for the outcome / resolution.

Wonder if it's related to https://lists.openinfosecfoundation.org/pipermail/oisf-users/2016-January/005594.html

Well since recompiling it as requested with CFLAGS="-O0 ggdb" I've not seen any crash yet 8( Did not upgrade poring or kernel in-between so a little mytery.

Andre, do you happen to have some of the nic offloading features still on? Can you show output of 'ethtool -k <youriface>'?

Hello Victor,

Suricata uses input from 2 nic's (--pfring-int=eth4 --pfring-int=eth5)

1. ethtool -k eth4
   Features for eth4:
   rx-checksumming: on
   tx-checksumming: on
   tx-checksum-ipv4: on
   tx-checksum-unneeded: off [fixed]
   tx-checksum-ip-generic: off [fixed]
   tx-checksum-ipv6: on
   tx-checksum-fcoe-crc: on [fixed]
   tx-checksum-sctp: on
   scatter-gather: on
   tx-scatter-gather: on
   tx-scatter-gather-fraglist: off [fixed]
   tcp-segmentation-offload: on
   tx-tcp-segmentation: on
   tx-tcp-ecn-segmentation: off [fixed]
   tx-tcp6-segmentation: on
   udp-fragmentation-offload: off [fixed]
   generic-segmentation-offload: on
   generic-receive-offload: on
   large-receive-offload: on
   rx-vlan-offload: on
   tx-vlan-offload: on
   ntuple-filters: off
   receive-hashing: on
   highdma: on [fixed]
   rx-vlan-filter: on [fixed]
   vlan-challenged: off [fixed]
   tx-lockless: off [fixed]
   netns-local: off [fixed]
   tx-gso-robust: off [fixed]
   tx-fcoe-segmentation: on [fixed]
   tx-gre-segmentation: off [fixed]
   tx-udp_tnl-segmentation: off [fixed]
   fcoe-mtu: off [fixed]
   loopback: off [fixed]

1. ethtool -k eth5
   Features for eth5:
   rx-checksumming: on
   tx-checksumming: on
   tx-checksum-ipv4: on
   tx-checksum-unneeded: off [fixed]
   tx-checksum-ip-generic: off [fixed]
   tx-checksum-ipv6: on
   tx-checksum-fcoe-crc: on [fixed]
   tx-checksum-sctp: on
   scatter-gather: on
   tx-scatter-gather: on
   tx-scatter-gather-fraglist: off [fixed]
   tcp-segmentation-offload: on
   tx-tcp-segmentation: on
   tx-tcp-ecn-segmentation: off [fixed]
   tx-tcp6-segmentation: on
   udp-fragmentation-offload: off [fixed]
   generic-segmentation-offload: on
   generic-receive-offload: on
   large-receive-offload: on
   rx-vlan-offload: on
   tx-vlan-offload: on
   ntuple-filters: off
   receive-hashing: on
   highdma: on [fixed]
   rx-vlan-filter: on [fixed]
   vlan-challenged: off [fixed]
   tx-lockless: off [fixed]
   netns-local: off [fixed]
   tx-gso-robust: off [fixed]
   tx-fcoe-segmentation: on [fixed]
   tx-gre-segmentation: off [fixed]
   tx-udp_tnl-segmentation: off [fixed]
   fcoe-mtu: off [fixed]
   loopback: off [fixed]

Crash today at 13:09 CET, running since a service restart at 07:00 CET today.

RxPFReth51⁶⁰³⁷⁷: segfault at 7fe120109000 ip 000000000061980b sp 00007fe120b072f0 error 4 in suricata[400000+2cb000]

]# ethtool -k eth5
Features for eth5:
rx-checksumming: off
tx-checksumming: off
tx-checksum-ipv4: off
tx-checksum-unneeded: off [fixed]
tx-checksum-ip-generic: off [fixed]
tx-checksum-ipv6: off
tx-checksum-fcoe-crc: on [fixed]
tx-checksum-sctp: off
scatter-gather: off
tx-scatter-gather: off
tx-scatter-gather-fraglist: off [fixed]
tcp-segmentation-offload: off
tx-tcp-segmentation: off
tx-tcp-ecn-segmentation: off [fixed]
tx-tcp6-segmentation: off
udp-fragmentation-offload: off [fixed]
generic-segmentation-offload: off
generic-receive-offload: off
large-receive-offload: off
rx-vlan-offload: off
tx-vlan-offload: off
ntuple-filters: off
receive-hashing: on
highdma: on [fixed]
rx-vlan-filter: on [fixed]
vlan-challenged: off [fixed]
tx-lockless: off [fixed]
netns-local: off [fixed]
tx-gso-robust: off [fixed]
tx-fcoe-segmentation: on [fixed]
tx-gre-segmentation: off [fixed]
tx-udp_tnl-segmentation: off [fixed]
fcoe-mtu: off [fixed]
loopback: off [fixed]

]# suricata --build-info
This is Suricata version 3.0 RELEASE
Features: PCAP_SET_BUFF LIBPCAP_VERSION_MAJOR=1 PF_RING AF_PACKET HAVE_PACKET_FANOUT LIBCAP_NG LIBNET1.1 HAVE_HTP_URI_NORMALIZE_HOOK PCRE_JIT HAVE_NSS HAVE_LUA HAVE_LUAJIT HAVE_LIBJANSSON TLS
SIMD support: SSE_4_2 SSE_4_1 SSE_3
Atomic intrisics: 1 2 4 8 16 byte(s)
64-bits, Little-endian architecture
GCC version 4.4.7 20120313 (Red Hat 4.4.7-16), C version 199901
compiled with -fstack-protector
compiled with _FORTIFY_SOURCE=2
L1 cache line size (CLS)=64
thread local storage method: __thread
compiled with LibHTP v0.5.18, linked against LibHTP v0.5.18

Suricata Configuration:
AF_PACKET support: yes
PF_RING support: yes
NFQueue support: no
NFLOG support: no
IPFW support: no
Netmap support: no
DAG enabled: no
Napatech enabled: no

Unix socket enabled:                     yes
  Detection enabled:                       yes

libnss support:                          yes
  libnspr support:                         yes
  libjansson support:                      yes
  hiredis support:                         no
  Prelude support:                         no
  PCRE jit:                                yes
  LUA support:                             yes, through luajit
  libluajit:                               yes
  libgeoip:                                yes
  Non-bundled htp:                         no
  Old barnyard2 support:                   yes
  CUDA enabled:                            no

Suricatasc install:                      yes

Unit tests enabled:                      no
  Debug output enabled:                    no
  Debug validation enabled:                no
  Profiling enabled:                       no
  Profiling locks enabled:                 no
  Coccinelle / spatch:                     no

Generic build parameters:
Installation prefix: /usr
Configuration directory: /etc/suricata/
Log directory: /var/log/suricata/

--prefix                                 /usr
  --sysconfdir                             /etc
  --localstatedir                          /var

Host:                                    x86_64-unknown-linux-gnu
  Compiler:                                gcc (exec name) / gcc (real)
  GCC Protect enabled:                     yes
  GCC march native enabled:                yes
  GCC Profile enabled:                     no
  Position Independent Executable enabled: no
  CFLAGS                                   -O0 -ggdb -march=native
  PCAP_CFLAGS                               -I/usr/local/include
  SECCFLAGS                                -fstack-protector -D_FORTIFY_SOURCE=2 -Wformat -Wformat-security

According to CFLAGS a crashdump should be generated , correct? But where to find it?