I'm having the same issue, running the same command. After running strace to analyze, I was able to find this. I'm tempted to say it can't handle more than 2^32 events for a single rule. .... read(0, "r/log/messages\nRule: 102000 (lev"..., 4096) = 4096 read(0, " 1242243111.1774923768: - local,"..., 4096) = 4096 read(0, "1)(PORT=56743)) * establish * nl"..., 4096) = 4096 brk(0xb7f2c000) = 0xb7f0b000 mmap2(NULL, 1048576, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = -1 ENOMEM (Cannot allocate memory) mmap2(NULL, 2097152, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS| MAP_NORESERVE, -1, 0) = -1 ENOMEM (Cannot allocate memory) mmap2(NULL, 1048576, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS| MAP_NORESERVE, -1, 0) = -1 ENOMEM (Cannot allocate memory) mmap2(NULL, 2097152, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS| MAP_NORESERVE, -1, 0) = -1 ENOMEM (Cannot allocate memory) mmap2(NULL, 1048576, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS| MAP_NORESERVE, -1, 0) = -1 ENOMEM (Cannot allocate memory) time(NULL) = 1242840090 brk(0xb7f2c000) = 0xb7f0b000 mmap2(NULL, 1048576, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = -1 ENOMEM (Cannot allocate memory) mmap2(NULL, 2097152, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS| MAP_NORESERVE, -1, 0) = -1 ENOMEM (Cannot allocate memory) mmap2(NULL, 1048576, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS| MAP_NORESERVE, -1, 0) = -1 ENOMEM (Cannot allocate memory) mmap2(NULL, 2097152, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS| MAP_NORESERVE, -1, 0) = -1 ENOMEM (Cannot allocate memory) mmap2(NULL, 1048576, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS| MAP_NORESERVE, -1, 0) = -1 ENOMEM (Cannot allocate memory) write(2, "2009/05/20 10:21:30 ", 202009/05/20 10:21:30 ) = 20 write(2, "ossec-reportd(1102): ERROR: Not "..., 55ossec-reportd(1102): ERROR: Not enough Memory. Exiting.) = 55 write(2, "\n", 1 ) = 1 brk(0xb7f2c000) = 0xb7f0b000 mmap2(NULL, 1048576, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = -1 ENOMEM (Cannot allocate memory) mmap2(NULL, 2097152, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS| MAP_NORESERVE, -1, 0) = -1 ENOMEM (Cannot allocate memory) mmap2(NULL, 1048576, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS| MAP_NORESERVE, -1, 0) = -1 ENOMEM (Cannot allocate memory) mmap2(NULL, 2097152, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS| MAP_NORESERVE, -1, 0) = -1 ENOMEM (Cannot allocate memory) mmap2(NULL, 1048576, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS| MAP_NORESERVE, -1, 0) = -1 ENOMEM (Cannot allocate memory) time(NULL) = 1242840090 brk(0xb7f2c000) = 0xb7f0b000 mmap2(NULL, 1048576, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = -1 ENOMEM (Cannot allocate memory) mmap2(NULL, 2097152, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS| MAP_NORESERVE, -1, 0) = -1 ENOMEM (Cannot allocate memory) mmap2(NULL, 1048576, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS| MAP_NORESERVE, -1, 0) = -1 ENOMEM (Cannot allocate memory) mmap2(NULL, 2097152, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS| MAP_NORESERVE, -1, 0) = -1 ENOMEM (Cannot allocate memory) mmap2(NULL, 1048576, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS| MAP_NORESERVE, -1, 0) = -1 ENOMEM (Cannot allocate memory) write(2, "2009/05/20 10:21:30 ", 202009/05/20 10:21:30 ) = 20 write(2, "ossec-reportd(1102): ERROR: Not "..., 55ossec-reportd(1102): ERROR: Not enough Memory. Exiting.) = 55 write(2, "\n", 1 ) = 1 brk(0xb7f2c000) = 0xb7f0b000 mmap2(NULL, 1048576, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = -1 ENOMEM (Cannot allocate memory) mmap2(NULL, 2097152, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS| MAP_NORESERVE, -1, 0) = -1 ENOMEM (Cannot allocate memory) mmap2(NULL, 1048576, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS| MAP_NORESERVE, -1, 0) = -1 ENOMEM (Cannot allocate memory) mmap2(NULL, 2097152, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS| MAP_NORESERVE, -1, 0) = -1 ENOMEM (Cannot allocate memory) mmap2(NULL, 1048576, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS| MAP_NORESERVE, -1, 0) = -1 ENOMEM (Cannot allocate memory) time(NULL) = 1242840090 brk(0xb7f2c000) = 0xb7f0b000 mmap2(NULL, 1048576, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = -1 ENOMEM (Cannot allocate memory) mmap2(NULL, 2097152, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS| MAP_NORESERVE, -1, 0) = -1 ENOMEM (Cannot allocate memory) mmap2(NULL, 1048576, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS| MAP_NORESERVE, -1, 0) = -1 ENOMEM (Cannot allocate memory) mmap2(NULL, 2097152, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS| MAP_NORESERVE, -1, 0) = -1 ENOMEM (Cannot allocate memory) mmap2(NULL, 1048576, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS| MAP_NORESERVE, -1, 0) = -1 ENOMEM (Cannot allocate memory) write(2, "2009/05/20 10:21:30 ", 202009/05/20 10:21:30 ) = 20 write(2, "ossec-reportd(1102): ERROR: Not "..., 55ossec-reportd(1102): ERROR: Not enough Memory. Exiting.) = 55 write(2, "\n", 1 ) = 1 brk(0xb7f2c000) = 0xb7f0b000 mmap2(NULL, 1048576, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = -1 ENOMEM (Cannot allocate memory) mmap2(NULL, 2097152, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS| MAP_NORESERVE, -1, 0) = -1 ENOMEM (Cannot allocate memory) mmap2(NULL, 1048576, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS| MAP_NORESERVE, -1, 0) = -1 ENOMEM (Cannot allocate memory) mmap2(NULL, 2097152, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS| MAP_NORESERVE, -1, 0) = -1 ENOMEM (Cannot allocate memory) mmap2(NULL, 1048576, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS| MAP_NORESERVE, -1, 0) = -1 ENOMEM (Cannot allocate memory) time(NULL) = 1242840090 brk(0xb7f2c000) = 0xb7f0b000 mmap2(NULL, 1048576, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = -1 ENOMEM (Cannot allocate memory) mmap2(NULL, 2097152, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS| MAP_NORESERVE, -1, 0) = -1 ENOMEM (Cannot allocate memory) mmap2(NULL, 1048576, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS| MAP_NORESERVE, -1, 0) = -1 ENOMEM (Cannot allocate memory) mmap2(NULL, 2097152, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS| MAP_NORESERVE, -1, 0) = -1 ENOMEM (Cannot allocate memory) mmap2(NULL, 1048576, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS| MAP_NORESERVE, -1, 0) = -1 ENOMEM (Cannot allocate memory) write(2, "2009/05/20 10:21:30 ", 202009/05/20 10:21:30 ) = 20 write(2, "shared-libs(1102): ERROR: Not en"..., 53shared-libs(1102): ERROR: Not enough Memory. Exiting.) = 53 write(2, "\n", 1 ) = 1 exit_group(1) = ? Process 24459 detached
On May 14, 10:26 am, "Derek J. Morris" <[email protected]> wrote: > Here is the code I use to run this: > > cd /var/ossec/ > > zcat /var/ossec/logs/alerts/2009/Mar/*.gz | ./src/monitord/ossec-reportd -n > "Month Summary" > > > > > > > Hi Derek, > > > What command (and arguments) are you using? It seems that it is trying to > allocate > > more than what you have available. > > > Thanks, > > > -- > > Daniel B. Cid > > dcid ( at ) ossec.net > > > On Mon, May 4, 2009 at 4:40 PM, Derek J. Morris > > <[email protected]> wrote: > > >> My monthly summary report wont run. I get: > > >> 2009/05/02 00:15:01 ossec-reportd: INFO: Started (pid: 22713). > >> 2009/05/02 00:18:18 shared-libs(1102): ERROR: Not enough Memory. Exiting.
