Strange swap behaviour

[Paul Schmehl]

Andrea Venturoli wrote:
> Hello.
> 
> A server of mine is running 6.1/amd64 with 1GiB of RAM.
>  From time to time swap use will grow enormously and performance will 
> suffer from this; also the nightly clamav run will not complete, as the 
> process will get killed due to lack of swap space.
> The day after I'll look into top and see this two processes are the 
> largest ones:
>>   672 snort          1 -58    0  4007M 62344K bpf    0   8:53  0.00% 
>> snort
>>   669 snort          1 -58    0   323M 29704K bpf    1   1:45  0.00% 
>> snort
> 
I'm having the exact same problem on 6.0/amd64.  I commented out the 
stream4 preprocessor lines in the snort.conf file and the problem went 
away.  I just uncommented them this morning, to confirm that that is 
what is causing the problem.

It appears that there is a memory leak in the stream4 preprocessor, but 
before I report it, I want to confirm that the symptoms are repeatable.

-- 
Paul Schmehl (pauls at utdallas.edu)
Adjunct Information Security Officer
The University of Texas at Dallas
http://www.utdallas.edu/ir/security/
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 5007 bytes
Desc: S/MIME Cryptographic Signature
Url : http://lists.freebsd.org/pipermail/freebsd-questions/attachments/20060608/dc08556a/smime.bin