Project

General

Profile

Actions
Copy link

Bug #1827

closed

Mpm AC fails to alloc memory

Added by Sahil Bhola almost 8 years ago. Updated about 7 years ago.

Status:
Closed
Priority:
Normal
Assignee:
Sascha Steinbiss
Target version:
3.2.1
Affected Versions:
Effort:
Difficulty:
Label:

Description

I am getting a below error while starting suricata services. Can you please help with how I can fix this issue.

[root@suricata ~]# suricata -c /etc/suricata/suricata.yaml -s /var/data/***/md5.rules --af-packet=ens160 
Initialization syslog logging with format "[%i] <%d> -- ".
24/6/2016 -- 11:01:53 - <Notice> - This is Suricata version 3.0.1 RELEASE
24/6/2016 -- 11:02:37 - <Error> - [ERRCODE: SC_ERR_MEM_ALLOC(1)] - SCRealloc failed: Cannot allocate memory, while trying to allocate 18446744071562067968 bytes
24/6/2016 -- 11:02:37 - <Error> - [ERRCODE: SC_ERR_FATAL(171)] - Out of memory. The engine cannot be initialized. Exiting...

Files

Download all files
Suricata.zip (3.39 MB) Suricata.zip Sahil Bhola, 06/27/2016 08:45 AM
suricatalogs.txt (42 KB) suricatalogs.txt Sahil Bhola, 06/27/2016 09:41 AM
Actions
Copy link
 #1

Updated by Victor Julien almost 8 years ago

  • Description updated (diff)
Actions
Copy link
 #2

Updated by Victor Julien almost 8 years ago

What are the steps to reproduce? Can you share your yaml & rules? What hardware do you use?

Actions
Copy link
 #3

Updated by Sahil Bhola almost 8 years ago

I am running Suricata on a VM with 8 cores and 32 gb ram. Also I have attached the necessary files - Suricata.yaml, Rules and iprep to reproduce the issue. Please let me know if you want any other information.

Thanks

Sahil

Actions
Copy link
 #4

Updated by Sahil Bhola almost 8 years ago

Also I am attaching the complete output when I am starting Suricata services. Please find attached the suricata output file.

Actions
Copy link
 #5

Updated by Andreas Herz almost 8 years ago

Did you try to remove some rules or iprep? For example the phishing.rules to see if you can narrow it down to some specific ruleset or the amount of rules?

Actions
Copy link
 #6

Updated by Peter Manev almost 8 years ago

The err message :

SCRealloc failed: Cannot allocate memory, while trying to allocate 18446744071562067968 bytes

looks exactly the same as in https://redmine.openinfosecfoundation.org/issues/1843
so it may be related.

Actions
Copy link
 #7

Updated by Sahil Bhola over 7 years ago

Yeah, its exactly the same error. Is there any information needed from my side?

Please let me know if you have any questions for me.

Actions
Copy link
 #8

Updated by Andreas Herz over 7 years ago

Sahil Bhola wrote:

Yeah, its exactly the same error. Is there any information needed from my side?

Please let me know if you have any questions for me.

"Did you try to remove some rules or iprep? For example the phishing.rules to see if you can narrow it down to some specific ruleset or the amount of rules?" :)
Maybe you have overseen my questions.

Actions
Copy link
 #9

Updated by Andreas Herz over 7 years ago

  • Target version set to TBD
Actions
Copy link
 #11

Updated by Victor Julien about 7 years ago

  • Subject changed from ERRCODE: SC_ERR_MEM_ALLOC(1)] to Mpm AC fails to alloc memory
  • Status changed from New to Assigned
  • Target version changed from TBD to 70
Actions
Copy link
 #12

Updated by Victor Julien about 7 years ago

  • Assignee changed from Victor Julien to Sascha Steinbiss
Actions
Copy link
 #13

Updated by Victor Julien about 7 years ago

  • Status changed from Assigned to Closed
  • Target version changed from 70 to 3.2.1
Actions
Copy link
 #14

Updated by Victor Julien about 7 years ago

  • Tracker changed from Support to Bug
Actions
Copy link

Also available in: Atom PDF