Guest User!

You are not Sophos Staff.

This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

SNORT high load average killing all connections

This is the second time it has happened.. but on my XG firewall SNORT is murdering my firewalls and making them unusable.  WHYYY!!???

Seriously though.. did anyone else have this happen today or know what causes it?



This thread was automatically locked due to age.
Parents
  • Hi,

    firewall hardware version and software version will help with the responses, line speed, number of users etc.

    Ian

  • SFOS 18.0.5 MR-5-Build586  Less than 500 users on a XG330.  This is the second time this has happened. The CPU is pegged and the load average shoots up to 10.00 Thankfully I have been able to SSH in and kill off all of the hung SNORT processes which brings the load average down below 1.00 and data starts processing again.

    I am not sure if this is pattern update related.  Both times this has happened over night into the morning and we have been able to catch it without needing to reboot the firewalls or something like that.  I will gladly post logs or anything else needed.  

Reply
  • SFOS 18.0.5 MR-5-Build586  Less than 500 users on a XG330.  This is the second time this has happened. The CPU is pegged and the load average shoots up to 10.00 Thankfully I have been able to SSH in and kill off all of the hung SNORT processes which brings the load average down below 1.00 and data starts processing again.

    I am not sure if this is pattern update related.  Both times this has happened over night into the morning and we have been able to catch it without needing to reboot the firewalls or something like that.  I will gladly post logs or anything else needed.  

Children