This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Snort on Astaro 3.2

Maybe someone can give me a quick sanity check :-)

I have Snort 1.9.0 running on my Astaro box, and it works great except for the "Too much memory for 1 process" errors that it posts (Then mails me).

I like the alerts when a process has grown too large, but I want to have it skip the snort process. I could probably dig through and make the modifications, but I wanted to post here first to see if anyone has done this. Any good ways to remove the one process from the Memory checks?

Haplo

This thread was automatically locked due to age.

Parents

0 oliver.desch over 22 years ago

Haplo Patryn,

it isn't possible to exclude it but you could
increase the default value for the alert in
/etc/wfe/conf/selfmonitoring to a workable
value - assuming you have enough RAM [;)]

read you
o|iver
Cancel
Vote Up 0 Vote Down

Cancel
0 Haplo Patryn over 22 years ago in reply to oliver.desch

Thanks for the info!  I have actually changed my methods here.  I was reluctant to run snort on my firewall, but at the time, it was the best place to put it to see all the traffic that was making it in to the network, and all that was passing out of the network.

I am now working on finishing an ipless BSD bridge that is just going to flow the packets to the firewall, and snort is going to be the only thing run there.  That way, I will see EVERYTHING to/from the hosts on my network, including things that would be dropped by the firewall.

Once again, thanks for the help!  Every little tidbit of information I can gain is very helpful.

Haplo
Cancel
Vote Up 0 Vote Down

Cancel
0 JimmyM over 22 years ago in reply to Haplo Patryn

Is the value in bytes or Kbytes?
Cancel
Vote Up 0 Vote Down

Cancel
0 oliver.desch over 22 years ago in reply to JimmyM

KiloBytes!
Cancel
Vote Up 0 Vote Down

Cancel
0 devilrunner over 22 years ago in reply to oliver.desch

Can you or anybody else give me some pointers into making a project like you mentioned....ipless BSD bridge that just does snort.
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 devilrunner over 22 years ago in reply to oliver.desch

Can you or anybody else give me some pointers into making a project like you mentioned....ipless BSD bridge that just does snort.
Cancel
Vote Up 0 Vote Down

Cancel

Children

No Data