Project

General

Profile

Actions
Copy link

Bug #1827

closed
SB SS

Mpm AC fails to alloc memory

Bug #1827: Mpm AC fails to alloc memory

Added by Sahil Bhola almost 10 years ago. Updated about 9 years ago.

Status:
Closed
Priority:
Normal
Assignee:
Sascha Steinbiss
Target version:
3.2.1
Affected Versions:
Effort:
Difficulty:
Label:

Description

I am getting a below error while starting suricata services. Can you please help with how I can fix this issue.

[root@suricata ~]# suricata -c /etc/suricata/suricata.yaml -s /var/data/***/md5.rules --af-packet=ens160 
Initialization syslog logging with format "[%i] <%d> -- ".
24/6/2016 -- 11:01:53 - <Notice> - This is Suricata version 3.0.1 RELEASE
24/6/2016 -- 11:02:37 - <Error> - [ERRCODE: SC_ERR_MEM_ALLOC(1)] - SCRealloc failed: Cannot allocate memory, while trying to allocate 18446744071562067968 bytes
24/6/2016 -- 11:02:37 - <Error> - [ERRCODE: SC_ERR_FATAL(171)] - Out of memory. The engine cannot be initialized. Exiting...

Files

Download all files
Suricata.zip (3.39 MB) Suricata.zip Sahil Bhola, 06/27/2016 08:45 AM
suricatalogs.txt (42 KB) suricatalogs.txt Sahil Bhola, 06/27/2016 09:41 AM

VJ Updated by Victor Julien almost 10 years ago Actions
Copy link
 #1

  • Description updated (diff)

VJ Updated by Victor Julien almost 10 years ago Actions
Copy link
 #2

What are the steps to reproduce? Can you share your yaml & rules? What hardware do you use?

SB Updated by Sahil Bhola almost 10 years ago Actions
Copy link
 #3

I am running Suricata on a VM with 8 cores and 32 gb ram. Also I have attached the necessary files - Suricata.yaml, Rules and iprep to reproduce the issue. Please let me know if you want any other information.

Thanks

Sahil

SB Updated by Sahil Bhola almost 10 years ago Actions
Copy link
 #4

Also I am attaching the complete output when I am starting Suricata services. Please find attached the suricata output file.

AH Updated by Andreas Herz almost 10 years ago Actions
Copy link
 #5

Did you try to remove some rules or iprep? For example the phishing.rules to see if you can narrow it down to some specific ruleset or the amount of rules?

PM Updated by Peter Manev over 9 years ago Actions
Copy link
 #6

The err message :

SCRealloc failed: Cannot allocate memory, while trying to allocate 18446744071562067968 bytes

looks exactly the same as in https://redmine.openinfosecfoundation.org/issues/1843
so it may be related.

SB Updated by Sahil Bhola over 9 years ago Actions
Copy link
 #7

Yeah, its exactly the same error. Is there any information needed from my side?

Please let me know if you have any questions for me.

AH Updated by Andreas Herz over 9 years ago Actions
Copy link
 #8

Sahil Bhola wrote:

Yeah, its exactly the same error. Is there any information needed from my side?

Please let me know if you have any questions for me.

"Did you try to remove some rules or iprep? For example the phishing.rules to see if you can narrow it down to some specific ruleset or the amount of rules?" :)
Maybe you have overseen my questions.

AH Updated by Andreas Herz over 9 years ago Actions
Copy link
 #9

  • Target version set to TBD

VJ Updated by Victor Julien about 9 years ago Actions
Copy link
 #11

  • Subject changed from ERRCODE: SC_ERR_MEM_ALLOC(1)] to Mpm AC fails to alloc memory
  • Status changed from New to Assigned
  • Target version changed from TBD to 70

VJ Updated by Victor Julien about 9 years ago Actions
Copy link
 #12

  • Assignee changed from Victor Julien to Sascha Steinbiss

VJ Updated by Victor Julien about 9 years ago Actions
Copy link
 #13

  • Status changed from Assigned to Closed
  • Target version changed from 70 to 3.2.1

VJ Updated by Victor Julien about 9 years ago Actions
Copy link
 #14

  • Tracker changed from Support to Bug
Actions
Copy link

Also available in: PDF Atom