update on information should be attached
regards
Richard A Lough
Subject: Re: snort: Snort now uses all available CPU cycles contiuously
Followup-For: Bug #519590
Package: snort
Version: 2.9.5.3-3
Dear Maintainer,
*** Please consider answering these questions, where appropriate ***
* What led up to the situation?
My best guess is that my upgrade to this version caused the bug to
appear.
* What exactly did you do (or not do) that was effective (or
ineffective)?
I downgraded to the version of snort currently available from Debian|wheezy
* What was the outcome of this action?
On the current, installed version of snort, one cpu runs at near 100%
continuously with nothing appearing in the log. If I change the interface from
eth1 to eth0 (eth0 is unused) the cpu cycles fall to near zero.
I have tried different linux kernels, none seemed to help.
Reverting to the snort version available from "wheezy" restores normal
operation, as far as I can tell.
-- System Information:
Debian Release: jessie/sid
APT prefers testing
APT policy: (500, 'testing')
Architecture: amd64 (x86_64)
Kernel: Linux 3.11.8 (SMP w/4 CPU cores)
Locale: LANG=en_GB.UTF-8, LC_CTYPE=en_GB.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Versions of packages snort depends on:
pn adduser <none>
pn debconf | debconf-2.0 <none>
pn libc6 <none>
pn libdaq0 <none>
pn libdumbnet1 <none>
pn libpcap0.8 <none>
pn libpcre3 <none>
pn logrotate <none>
pn net-tools <none>
pn rsyslog | system-log-daemon <none>
ii snort-common 2.9.5.3-3
ii snort-common-libraries 2.9.5.3-3
ii snort-rules-default 2.9.5.3-3
pn zlib1g <none>
Versions of packages snort recommends:
pn iproute2 <none>
Versions of packages snort suggests:
pn snort-doc <none>
-- debconf information:
snort/invalid_interface:
* snort/send_stats: true
* snort/stats_treshold: 1
snort/disable_promiscuous: false
* snort/startup: boot
* snort/stats_rcpt: root
snort/config_parameters:
* snort/address_range: 192.168.1.0/24
snort/please_restart_manually:
* snort/interface: eth1
snort/options:
