Project

General

Profile

Actions

Bug #1827

closed

Mpm AC fails to alloc memory

Added by Sahil Bhola over 5 years ago. Updated over 4 years ago.

Status:
Closed
Priority:
Normal
Target version:
Affected Versions:
Effort:
Difficulty:
Label:

Description

I am getting a below error while starting suricata services. Can you please help with how I can fix this issue.

[root@suricata ~]# suricata -c /etc/suricata/suricata.yaml -s /var/data/***/md5.rules --af-packet=ens160 
Initialization syslog logging with format "[%i] <%d> -- ".
24/6/2016 -- 11:01:53 - <Notice> - This is Suricata version 3.0.1 RELEASE
24/6/2016 -- 11:02:37 - <Error> - [ERRCODE: SC_ERR_MEM_ALLOC(1)] - SCRealloc failed: Cannot allocate memory, while trying to allocate 18446744071562067968 bytes
24/6/2016 -- 11:02:37 - <Error> - [ERRCODE: SC_ERR_FATAL(171)] - Out of memory. The engine cannot be initialized. Exiting...

Files

Suricata.zip (3.39 MB) Suricata.zip Sahil Bhola, 06/27/2016 08:45 AM
suricatalogs.txt (42 KB) suricatalogs.txt Sahil Bhola, 06/27/2016 09:41 AM
Actions #1

Updated by Victor Julien over 5 years ago

  • Description updated (diff)
Actions #2

Updated by Victor Julien over 5 years ago

What are the steps to reproduce? Can you share your yaml & rules? What hardware do you use?

Actions #3

Updated by Sahil Bhola over 5 years ago

I am running Suricata on a VM with 8 cores and 32 gb ram. Also I have attached the necessary files - Suricata.yaml, Rules and iprep to reproduce the issue. Please let me know if you want any other information.

Thanks

Sahil

Actions #4

Updated by Sahil Bhola over 5 years ago

Also I am attaching the complete output when I am starting Suricata services. Please find attached the suricata output file.

Actions #5

Updated by Andreas Herz over 5 years ago

Did you try to remove some rules or iprep? For example the phishing.rules to see if you can narrow it down to some specific ruleset or the amount of rules?

Actions #6

Updated by Peter Manev over 5 years ago

The err message :

SCRealloc failed: Cannot allocate memory, while trying to allocate 18446744071562067968 bytes

looks exactly the same as in https://redmine.openinfosecfoundation.org/issues/1843
so it may be related.

Actions #7

Updated by Sahil Bhola about 5 years ago

Yeah, its exactly the same error. Is there any information needed from my side?

Please let me know if you have any questions for me.

Actions #8

Updated by Andreas Herz about 5 years ago

Sahil Bhola wrote:

Yeah, its exactly the same error. Is there any information needed from my side?

Please let me know if you have any questions for me.

"Did you try to remove some rules or iprep? For example the phishing.rules to see if you can narrow it down to some specific ruleset or the amount of rules?" :)
Maybe you have overseen my questions.

Actions #9

Updated by Andreas Herz about 5 years ago

  • Target version set to TBD
Actions #11

Updated by Victor Julien over 4 years ago

  • Subject changed from ERRCODE: SC_ERR_MEM_ALLOC(1)] to Mpm AC fails to alloc memory
  • Status changed from New to Assigned
  • Target version changed from TBD to 70
Actions #12

Updated by Victor Julien over 4 years ago

  • Assignee changed from Victor Julien to Sascha Steinbiss
Actions #13

Updated by Victor Julien over 4 years ago

  • Status changed from Assigned to Closed
  • Target version changed from 70 to 3.2.1
Actions #14

Updated by Victor Julien over 4 years ago

  • Tracker changed from Support to Bug
Actions

Also available in: Atom PDF