In my snort.conf, I have defrag, http_decode, portscan, and
portscan-ignorehosts enabled as preprocessors. No output plugins are
enabled.

Running it in the foreground (no -D), it complains of a Bus Error.
Checking other projects' lists, I noticed some complaints about the
optimization routines in gcc 2.95.x on Solaris producing similar
problems, so I compiled snort with -O0 (no optimization), rather than
the default -O2. It's been running for over two hours now without
coring, so I think that this might have done the trick.

Thanks for the input,

Tom

Thomas Whipp wrote:
>
> I've been running Snort for about 2 weeks with no
> instability on an Ultra 5 with Solaris 8, I've also tested
> it on Solaris 8 on a Netra T1 and Netra X1 without
> problems... what pre-processors/logging options do you have
> enabled?
>
> Tom
>
> > -----Original Message-----
> > From: Tom Kyle [mailto:tomeos.umsl.edu]
> > Sent: 04 June 2001 19:32
> > To: snort-userslists.sourceforge.net
> > Subject: [Snort-users] Snort dumps core on Solaris 8
> >
> >
> > I've been trying to use snort 1.7 that I compiled from
> source with gcc
> > 2.95.3 on an Ultra 5 running Solaris 8. Unfortunately, it
> dumps core
> > after running for some time (usually 30-120 minutes).
> > I'm using 'snort -Afull -c snort.conf -l /snort -d -D' to
> > invoke snort.
> > Is anyone aware of any issues with snort & Solaris 8, and
> if
> > so, of any
> > workarounds?
> >
> > Thanks!
> >
> > Tom
> >
> > --
> >
> > Thomas A. Kyle
> > Network Security Administrator
> > University of Missouri-St. Louis
> > tkylejinx.umsl.edu
> > (314) 516-6012
> >
> > _______________________________________________
> > Snort-users mailing list
> > Snort-userslists.sourceforge.net
> > Go to this URL to change user options or unsubscribe:
> > http://lists.sourceforge.net/lists/listinfo/snort-users
> > Snort-users list archive:
> > http://www.geocrawler.com/redir-sf.php3?list=snort-users
> >
>
> _______________________________________________
> Snort-users mailing list
> Snort-userslists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> http://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users

-- 
Thomas A. Kyle
Network Security Administrator
University of Missouri-St. Louis
tkylejinx.umsl.edu
(314) 516-6012
_______________________________________________
Snort-users mailing list
Snort-userslists.sourceforge.net
Go to this URL to change user options or unsubscribe:
http://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]