Package: snort Version: 2.7.0-22 Severity: important I have had snort installed for several years without any issues. The last update has changed snort's behavior so now it is utilizing all available CPU cycles and memory usage. I set the lowmem setting which has helped the memory, but I haven't figured out how to lower the CPU load. I have another identical server running ubuntu gutsy with the ubuntu 2.7.0-6 snort version, without any noticable CPU or memory issues.
I was also concerned that an older configuration file might cause issues, so I purged snort and associated packages, removed the older configuration files and reinstalled snort, with the same behavior. -- System Information: Debian Release: squeeze/sid APT prefers testing-proposed-updates APT policy: (500, 'testing-proposed-updates'), (500, 'oldstable'), (500, 'testing'), (500, 'stable') Architecture: sparc (sparc64) Kernel: Linux 2.6.24firewall.2.f Locale: LANG=C, LC_CTYPE=C (charmap=ANSI_X3.4-1968) Shell: /bin/sh linked to /bin/bash Versions of packages snort depends on: ii adduser 3.110 add and remove users and groups ii debconf [debconf-2.0] 1.5.25 Debian configuration management sy ii libc6 2.9-4 GNU C Library: Shared libraries ii libgcrypt11 1.4.4-2 LGPL Crypto library - runtime libr ii libgnutls26 2.6.4-2 the GNU TLS library - runtime libr ii libgpg-error0 1.4-2 library for common error values an ii libltdl3 1.5.26-4 A system independent dlopen wrappe ii libpcap0.8 1.0.0-1 system interface for user-level pa ii libpcre3 7.8-2 Perl 5 Compatible Regular Expressi ii libprelude2 0.9.18.1-1 Hybrid Intrusion Detection System ii libtasn1-3 1.8-1 Manage ASN.1 structures (runtime) ii logrotate 3.7.7-3 Log rotation utility ii snort-common 2.7.0-22 flexible Network Intrusion Detecti ii snort-common-libraries 2.7.0-22 flexible Network Intrusion Detecti ii snort-rules-default 2.7.0-22 flexible Network Intrusion Detecti ii sysklogd [system-log-d 1.5-5 System Logging Daemon ii zlib1g 1:1.2.3.3.dfsg-12 compression library - runtime Versions of packages snort recommends: ii iproute 20080725-2 networking and traffic control too Versions of packages snort suggests: pn snort-doc <none> (no description available) -- debconf information: * snort/address_range: 192.168.0.0/16 snort/startup: boot snort/options: snort/invalid_interface: * snort/interface: eth2 eth4 * snort/stats_rcpt: root snort/send_stats: true snort/config_parameters: * snort/config_error: snort/please_restart_manually: snort/reverse_order: false snort/stats_treshold: 1 snort/disable_promiscuous: false -- To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org
