Optimization #551: Replace SCLogError by a counter for memory issue and other memcap - Suricata - Open Information Security Foundation

Subject changed from Replace SCLlogError by a counter for memory issue and other memcap to Replace SCLogError by a counter for memory issue and other memcap

We've got 145 occurances of 'SCLogError(SC_ERR_MEM_ALLOC' in the code. There is no way to know if a function is not an init function but to read it and understand its call graph. Doing that 145 may result in errors (for sure if I do it).
But even if it is done correctly we will need to have a lot of counters. Or we can just add one : malloc_failed.

On other complementary approach could be to rate limit this error message and use the previously mentioned counter.

What do you think ?

Actions

Copy link

Updated by Victor Julien over 11 years ago

Rate limiting is something we need regardless, can you open a separate ticket for that?

I'm fine with a single malloc counter. I think we will have review which ones are important, like mallocs at detection time. Maybe you can do a coccinelle search and replace on SCLogError(SC_ERR_MEM_ALLOC and do a trivial change (like add a comment). Then in the pull request we can easily inspect them one by one. Make sense?

Actions

Copy link