Optimization #551: Replace SCLogError by a counter for memory issue and other memcap - Suricata - Open Information Security Foundation

Actions

Copy link

Optimization #551

open

Replace SCLogError by a counter for memory issue and other memcap

Added by Eric Leblond over 11 years ago. Updated 9 months ago.

Status:

New

Priority:

Normal

Assignee:

OISF Dev

Target version:

TBD

Effort:

Difficulty:

Label:

Description

Using a SCLogError for memcap or other memory issues can lead to a lot of messages. They should be replaced by some counters.

Subtasks 1 (0 open — 1 closed)

Related issues 1 (1 open — 0 closed)

Actions

Copy link

Updated by Victor Julien over 11 years ago

Status changed from New to Assigned
Assignee set to Eric Leblond

Actions

Copy link

Updated by Eric Leblond over 11 years ago

Subject changed from Replace SCLlogError by a counter for memory issue and other memcap to Replace SCLogError by a counter for memory issue and other memcap

We've got 145 occurances of 'SCLogError(SC_ERR_MEM_ALLOC' in the code. There is no way to know if a function is not an init function but to read it and understand its call graph. Doing that 145 may result in errors (for sure if I do it).
But even if it is done correctly we will need to have a lot of counters. Or we can just add one : malloc_failed.

On other complementary approach could be to rate limit this error message and use the previously mentioned counter.

What do you think ?

Actions

Copy link

Updated by Victor Julien over 11 years ago

Rate limiting is something we need regardless, can you open a separate ticket for that?

I'm fine with a single malloc counter. I think we will have review which ones are important, like mallocs at detection time. Maybe you can do a coccinelle search and replace on SCLogError(SC_ERR_MEM_ALLOC and do a trivial change (like add a comment). Then in the pull request we can easily inspect them one by one. Make sense?

Actions

Copy link