[7.901][NOTABUG][CLOSED] Snort crashes under load

Hi,
I am running a bittorrent at the moment. The ASG is struggling performance wise. I expect the bittorrent to continue for a number of hours if somebody wants to login and have a look.

I was seeing a large number portscan notifications, but was not able to determine which rule to disable.
I disabled the workstation in IPS for both source and destination portscan and IPS protection, but before I did that snort stopped itself at least twice and restarted.
During a snort restart the http proxy becomes unresponsive. The IPv6 broker link also failed.

Ian M

Parents

0 Astaro Beta Bot over 15 years ago

Astaro Beta Report
--------------------------------
Version: 7.901
Type: NOTABUG
State: CLOSED
Reporter: RFCat_vk
Contributor: 
MantisID: 
Target version: 
Fixed in version: 
--------------------------------

0 67ef1d over 15 years ago in reply to Astaro Beta Bot

Is snort crashing? If it is, you should see something like
snort[pid]: segfault at ...
in "dmesg" output/kernel log.

If there are no such messages, then snort is being restarted by our middleware.
mdw/confd logs might show why that might be happening.

Do you have a multicore/smp machine?
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 RFCat_vk_01 over 15 years ago in reply to 67ef1d

Hi,
I have a dual cpu ASG.

You are correct it wasn't crashing, it was restarting as a result of my configuration changes to take the workstation out of the portscan protection list.
You can close this thread, thank you
Ian M
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel

Reply

0 RFCat_vk_01 over 15 years ago in reply to 67ef1d

Hi,
I have a dual cpu ASG.

You are correct it wasn't crashing, it was restarting as a result of my configuration changes to take the workstation out of the portscan protection list.
You can close this thread, thank you
Ian M
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel

Children

No Data