These forums have been switched to read-only mode as of March 1, 2011. The content that already existed here will be retained for posterity. No new posts will be accepted here. For more information and for the address of the new forums, see this page: http://snort.org/community/groups
Forums Support

S5: Pruned session

Subscribe to S5: Pruned session 1 post(s), 1 voice(s)

 
Avatar dpssoc 18 post(s)

Empty_starEmpty_starEmpty_starEmpty_starEmpty_star

Hi,
We using snort 2.8.1 with OS RHEL 5.
We have some error messages sent by Stream5 processor.

(these log messages have been anonymized)
Feb 9 14:09:57 host1 snort2986: S5: Pruned session from cache that was using 1382938 bytes (new data/timedout). 10.28.20.2 20499 -> 10.44.40.6 42271 (0) : LWstate 0×40e LWFlags 0×16007
Feb 9 14:27:01 host1 snort2986: S5: Pruned session from cache that was using 1088312 bytes (stale/timeout). 10.17.11.2 2061 -
> 10.16.1.11 1494 : LWstate 0xf LWFlags 0×16007
Feb 9 14:38:12 host1 snort2986: S5: Pruned session from cache that was using 1329188 bytes (new data/timedout). 10.13.17.10 4737 —> 10.97.4.5 54789 (0) : LWstate 0×40f LWFlags 0×16007

The trigger MEMCAP in stream5 processor is set to the Maximun (1073741824).

Someone have a idea to stop these messages ?
Thank

Forums Support

©2009 Snort and Sourcefire are registered trademarks of Sourcefire, Inc. All rights reserved. Terms of Use | Privacy Policy