Project

General

Profile

Bug #551

Replace SCLogError by a counter for memory issue and other memcap

Added by Eric Leblond about 7 years ago. Updated 6 months ago.

Status:
New
Priority:
Normal
Assignee:
Target version:
Affected Versions:
Effort:
Difficulty:
Label:

Description

Using a SCLogError for memcap or other memory issues can lead to a lot of messages. They should be replaced by some counters.


Subtasks

Bug #525: [ERRCODE: SC_ERR_MEM_ALLOC(1)]ClosedEric LeblondActions

Related issues

Related to Feature #614: Rate limiting messagesAssignedActions

History

#1

Updated by Victor Julien about 7 years ago

  • Status changed from New to Assigned
  • Assignee set to Eric Leblond
#2

Updated by Eric Leblond about 7 years ago

  • Subject changed from Replace SCLlogError by a counter for memory issue and other memcap to Replace SCLogError by a counter for memory issue and other memcap

We've got 145 occurances of 'SCLogError(SC_ERR_MEM_ALLOC' in the code. There is no way to know if a function is not an init function but to read it and understand its call graph. Doing that 145 may result in errors (for sure if I do it).
But even if it is done correctly we will need to have a lot of counters. Or we can just add one : malloc_failed.

On other complementary approach could be to rate limit this error message and use the previously mentioned counter.

What do you think ?

#3

Updated by Victor Julien about 7 years ago

Rate limiting is something we need regardless, can you open a separate ticket for that?

I'm fine with a single malloc counter. I think we will have review which ones are important, like mallocs at detection time. Maybe you can do a coccinelle search and replace on SCLogError(SC_ERR_MEM_ALLOC and do a trivial change (like add a comment). Then in the pull request we can easily inspect them one by one. Make sense?

#4

Updated by Victor Julien about 7 years ago

  • Target version changed from 1.4beta2 to 1.4beta3
#5

Updated by Victor Julien about 7 years ago

  • Target version changed from 1.4beta3 to 1.4rc1
#6

Updated by Victor Julien almost 7 years ago

  • Target version changed from 1.4rc1 to 2.0rc2
#7

Updated by Victor Julien almost 6 years ago

  • Target version changed from 2.0rc2 to 3.0RC2
#8

Updated by Victor Julien about 4 years ago

  • Target version changed from 3.0RC2 to Soon
#9

Updated by Eric Leblond over 1 year ago

  • Assignee deleted (Eric Leblond)
#10

Updated by Victor Julien over 1 year ago

  • Status changed from Assigned to New
  • Target version deleted (Soon)

Needs further thought before starting an implementation.

#11

Updated by Andreas Herz 6 months ago

  • Assignee set to OISF Dev
  • Target version set to TBD

Also available in: Atom PDF