Hello again all...
I had a few problems over the weekend relating to memory
allocation - which resulted in Snort spinning out and filling my disk.
I have this configuration:
# cat /proc/net/pf_ring/info
PF_RING Version : 4.1.2 ($Revision: 4132$)
Ring slots : 4096
Slot version : 10
Capture TX : Yes [RX+TX]
IP Defragment : No
Transparent mode : No
Total rings : 0
Total plugins : 0
but haven't so far moved to using a NIC driver patched for PF_RING
as I don't have the physical hardware present.
My problem seems to be that I have 1 application that runs for
30 minutes at a time and then dumps its output to file (ipaudit)
and Snort, which I restart every night to include updated rules
and also rotate logfiles.
This worked fine until this happening (the application rotates every 30
minutes):
Feb 14 06:30:01 netman3 kernel: [334273.434054] [PF_RING] removed
/proc/net/pf_r
ing/19029-eth1.82
Feb 14 06:30:01 netman3 kernel: [334273.472691] [PF_RING] successfully
allocated
880640 bytes at 0xffe5c000
Feb 14 06:30:01 netman3 kernel: [334273.472696] [PF_RING] allocated 4113
slots [
slot_len=214][tot_mem=880640]
Feb 14 06:30:01 netman3 kernel: [334273.475961] allocation failed: out of
vmalloc space - use vmalloc=<size> to increase size.
Feb 14 06:30:01 netman3 kernel: [334273.475967] [PF_RING] ERROR: not enough
memory for ring
Feb 14 06:30:01 netman3 kernel: [334273.475969] [PF_RING] ring_mmap():
unable to
allocate memory
Both of my applications (Snort/ipaudit) are using PF_RING fine so should
the kernel module be configured differently - or do I require the NIC
driver?
I know can't run any PF_RING-aware application because it is unable
to allocate the memory - do I have to reboot to cure this issue?
Thanks.
--
Peter Bates, Network Support & Development Officer
Goldsmiths, University of London
New Cross, London SE14 6NW. Telephone: 020 7919 7082
_______________________________________________
Ntop-misc mailing list
[email protected]
http://listgateway.unipi.it/mailman/listinfo/ntop-misc
