FreeBSD 4.2, 64megs ram, 128 megs swap. Snort 1.7.

Snort core dumps with a signal 11, segmentation violation. This shows up
in error logs:

tswapspace: failed
swap_pager_getswapspace: failed

How much swap does Snort need? Only other thing this machine does is MRTG
graphing, and runs apache. Of which there is only 2 of us that access the
machine via http. So the apache load is next to nothing.

I suppose I could add another swap partition, but I thought snort would be
able to run fine on this machine. It has an Intel etherexpress (fxp) card,
and is plugged into a switch, doing port mirroring, monitoring less than
10 megs of traffic.

Ive searchd the snort archives as well as the FreeBSD lists and find that
people run out of swap but not in relation to snort.

Snort was built from tarball not from the port. Built great, no warnings.
Any sort of fix for this? Swap in use right now is less than 2%.

Thanks,
Keith

_______________________________________________
Snort-users mailing list
Snort-userslists.sourceforge.net
Go to this URL to change user options or unsubscribe:
http://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]