Project

General

Profile

Actions

Bug #918

closed

suricata stops after a week or two of pushing files into unix socket

Added by April Lorenzen over 10 years ago. Updated almost 8 years ago.

Status:
Closed
Priority:
Normal
Assignee:
-
Target version:
-
Affected Versions:
Effort:
Difficulty:
Label:

Description

suricata -V
This is Suricata version 2.0dev (rev 055b422)

I don't know if this is a bug - don't even know if I should be stopping and starting suricata daily when I update the rules?

After restarting it, I did push the same pcap at it and it did not quit. However I didn't push the "next pcap" which could have been the one that killed it - if in fact it didn't just die for some other reason than contents of pcap. I am re-pushing that whole day of pcaps so it is possible it will stop again when it reaches a certain one.

This is how I start suricata:
suricata -c /usr/local/etc/suricata/suricata.yaml --unix-socket

Here's the tail end of the output just prior to it stopping:

[27892] 5/8/2013 -- 16:00:14 - (runmode-unix-socket.c:253) <Info> (UnixSocketAddPcapFile) -- Added file '/opt/pcaps/20130804/7c8/7c81470738480e763b92b6cfd7ad9e38.pcap' to list
[27892] 5/8/2013 -- 16:00:14 - (runmode-unix-socket.c:307) <Info> (UnixSocketPcapFilesCheck) -- Starting run for '/opt/pcaps/20130804/7c8/7c81470738480e763b92b6cfd7ad9e38.pcap'
[27892] 5/8/2013 -- 16:00:14 - (defrag-hash.c:203) <Info> (DefragInitConfig) -- allocated 3670016 bytes of memory for the defrag hash... 65536 buckets of size 56
[27892] 5/8/2013 -- 16:00:14 - (defrag-hash.c:228) <Info> (DefragInitConfig) -- preallocated 65535 defrag trackers of size 144
[27892] 5/8/2013 -- 16:00:14 - (defrag-hash.c:235) <Info> (DefragInitConfig) -- defrag memory usage: 13107056 bytes, maximum: 33554432
[27892] 5/8/2013 -- 16:00:14 - (stream-tcp.c:356) <Info> (StreamTcpInitConfig) -- stream "prealloc-sessions": 2048 (per thread)
[27892] 5/8/2013 -- 16:00:14 - (stream-tcp.c:372) <Info> (StreamTcpInitConfig) -- stream "memcap": 33554432
[27892] 5/8/2013 -- 16:00:14 - (stream-tcp.c:378) <Info> (StreamTcpInitConfig) -- stream "midstream" session pickups: disabled
[27892] 5/8/2013 -- 16:00:14 - (stream-tcp.c:384) <Info> (StreamTcpInitConfig) -- stream "async-oneside": disabled
[27892] 5/8/2013 -- 16:00:14 - (stream-tcp.c:401) <Info> (StreamTcpInitConfig) -- stream "checksum-validation": enabled
[27892] 5/8/2013 -- 16:00:14 - (stream-tcp.c:423) <Info> (StreamTcpInitConfig) -- stream."inline": disabled
[27892] 5/8/2013 -- 16:00:14 - (stream-tcp.c:436) <Info> (StreamTcpInitConfig) -- stream "max-synack-queued": 5
[27892] 5/8/2013 -- 16:00:14 - (stream-tcp.c:454) <Info> (StreamTcpInitConfig) -- stream.reassembly "memcap": 67108864
[27892] 5/8/2013 -- 16:00:14 - (stream-tcp.c:472) <Info> (StreamTcpInitConfig) -- stream.reassembly "depth": 1048576
[27892] 5/8/2013 -- 16:00:14 - (stream-tcp.c:555) <Info> (StreamTcpInitConfig) -- stream.reassembly "toserver-chunk-size": 2656
[27892] 5/8/2013 -- 16:00:14 - (stream-tcp.c:557) <Info> (StreamTcpInitConfig) -- stream.reassembly "toclient-chunk-size": 2674
[27892] 5/8/2013 -- 16:00:14 - (util-logopenfile.c:169) <Info> (SCConfLogOpenGeneric) -- fast output device (regular) initialized: fast.log
[27892] 5/8/2013 -- 16:00:14 - (alert-unified2-alert.c:1043) <Info> (Unified2AlertInitCtx) -- Unified2-alert initialized: filename unified2.alert, limit 32 MB
[27892] 5/8/2013 -- 16:00:14 - (util-logopenfile.c:169) <Info> (SCConfLogOpenGeneric) -- http-log output device (regular) initialized: http.log
[27892] 5/8/2013 -- 16:00:14 - (util-logopenfile.c:169) <Info> (SCConfLogOpenGeneric) -- dns-log output device (regular) initialized: dns.log
[27892] 5/8/2013 -- 16:00:14 - (log-filestore.c:591) <Info> (LogFilestoreLogInitCtx) -- forcing magic lookup for stored files
[27892] 5/8/2013 -- 16:00:14 - (log-filestore.c:600) <Info> (LogFilestoreLogInitCtx) -- md5 calculation requires linking against libnss
[27892] 5/8/2013 -- 16:00:14 - (log-filestore.c:615) <Info> (LogFilestoreLogInitCtx) -- storing files in /opt/pcaps/20130804/suricata/7c81470738480e763b92b6cfd7ad9e38/files
[27892] 5/8/2013 -- 16:00:14 - (util-logopenfile.c:169) <Info> (SCConfLogOpenGeneric) -- file-log output device (regular) initialized: files-json.log
[27892] 5/8/2013 -- 16:00:14 - (log-file.c:446) <Info> (LogFileLogInitCtx) -- forcing magic lookup for logged files
[27892] 5/8/2013 -- 16:00:14 - (log-file.c:455) <Info> (LogFileLogInitCtx) -- md5 calculation requires linking against libnss
[19165] 5/8/2013 -- 16:00:14 - (source-pcap-file.c:244) <Info> (ReceivePcapFileThreadInit) -- reading pcap file /opt/pcaps/20130804/7c8/7c81470738480e763b92b6cfd7ad9e38.pcap
[19166] 5/8/2013 -- 16:00:14 - (log-filestore.c:465) <Info> (LogFilestoreLogThreadInit) -- Created file drop directory /opt/pcaps/20130804/suricata/7c81470738480e763b92b6cfd7ad9e38/files
ERROR; return code from pthread_create() is 11
ERROR: TmThreadSpawn failed

Actions

Also available in: Atom PDF