On Mon, Nov 30, 2009 at 9:43 PM, Chris Buechler <[email protected]> wrote: > On Mon, Nov 30, 2009 at 5:27 AM, <[email protected]> wrote: >> Well, I uninstalled the Snort plugin after reading your mail. That may have >> been the cause. I guess a pentium III 900MHz just can't handle snort + PHP. > That's more than enough, must be some sort of problem with the Snort > package. Haven't seen that personally, we are doing some work on the > Snort package right now (primarily for 2.0), may run into or resolve > that in the process.
I've seen this on three production boxes now, and also seen two users that popped into the IRC channel mentioning the same. The problem seems to be with snort and the option(s): - Convert Snort alerts urls to clickable links - Associate events on Blocked tab If either or both are enabled and you enter the "Blocked" page, the page starts to load and seemingly stops loading. If you fire up top on a console, you see that PHP consumes 100% CPU. At work, we have a decent Dell R200 (Xeon based CPU and 4GB RAM) that spikes with 100% CPU usage on two cores. The execution of the PHP script doesn't seem to time out, and I have to manually kill the PHP processes to get things back to normal. Switching off the above options and then going back into the "Blocked" page, and everything is back to normal. -- Yours sincerely Jostein Elvaker Haande A free society is a place where it is safe to be unpopular http://tolecnal.net -- tolecnal at tolecnal dot net --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected] Commercial support available - https://portal.pfsense.org
