OOM errors on low end devices
As per a recent discussion on the mailing list, suricata-update takes up too much memory to run and causes OOM errors on low end devices like RPi.
- Status changed from Assigned to Closed
- Target version changed from Soon to 1.0.4
Marking closed for now. I think we've addressed all the low hanging fruit items we can without a redesign of the internals. Feedback from the user shows he is able to update the rules, without these changes, but has to use the --no-test parameter.
Updated by Konstantin Klinger 6 months ago
I think not only the rule testing is the problem here. Our suricata-update instance that runs on a seperate rulehost-server with 2GB RAM gets killed while running suricata-update, because lack of available memory.
This happens during the following line:
7/3/2019 -- 10:01:35 - <Info> -- Backing up current rules.
I think the diff function between the current rule file and the new one consumes to much memory and leads to the killing of the process.