When IPV6 is stopped or restarted another instance of snort is spawned. I have a dual processor machine so two more processes are spawned in addition to the one that is already running. These processes eventually die and you are left again with a single process.
The amount of memory utilized by snort increases dramatically after the reload.
Can reproduce it by turning off any interface or just reloading snort /var/mdw/scripts/snort reload . The amount of memory used on subsequent reloads varies and is usually more than the time before but is never in the magnitude of the first reload. Using /var/mdw/scripts/snort restart works without any adverse effects of excessive memory use but it does stop traffic flow.[;)]
Screenshot1: Snort using around 129meg ram about normal initially. (PID 20200)
Screenshot2: Multiple instances of snort are spawned. I guess that is the way the reload script is run. (PID 20200 still there also)
Screenshot3: Snort process status report during reload showing multiple instances.
Screenshot4: The memory usage jumped to 231mb after the reload. Quite a significant increase. (PID 20200)
Regards
Bill.
Guest User!
You are not Sophos Staff.
