Bug #525
closed
Optimization #551: Replace SCLogError by a counter for memory issue and other memcap
[ERRCODE: SC_ERR_MEM_ALLOC(1)]
Added by rahim ramezanian about 12 years ago.
Updated over 11 years ago.
Description
I run the suricata by the following command to read a pcap file
sudo suricata -c /etc/suricata/suricata.yaml -r /..../filename.pcap
but on the screen it shows the following errer in my terminal
[ERRCODE: SC_ERR_MEM_ALLOC(1)] - Defrag: Failed to allocate tracker.
If it is an error it should not be printed in my terminal screen as snort did not do it.
Best
What Suricata ver are you using?
suricata --build-info
would tell you that.
Because this was fixed in the current git master.
thanks
Hi
I am using v 1.3
thanks
Hi
I am using v 1.3, But I do not install it from git.
thanks
If you update to the current gitmaster - this should be fixed.
Please find some more info here :
http://planet.suricata-ids.org/
in the Article "Suricata, to 10Gbps and beyond" from the 30July, section "Defrag".
Thanks
Is this an actual memory allocation failure or did we hit an internal memcap in the defrag engine?
You may need to increase the "defrag.trackers" variable when this problem occurs.
I mean to modify:
defrag:
trackers: 65535
- Status changed from New to Assigned
- Assignee set to Eric Leblond
- Target version set to 1.4beta3
- Parent task set to #551
Has defrag code rewrite indirectly triggered a "need to close" on this ticket ?
I see 2 error logs in case of PacketDefragPktSetup that we should fix.
- Target version changed from 1.4beta3 to 1.4rc1
- Target version changed from 1.4rc1 to 2.0rc2
- Status changed from Assigned to Closed
- Target version deleted (
2.0rc2)
Closing this as the larger issue is addressed by #551.
Also available in: Atom
PDF