Snort 3 sigusr1 handling
Johnston Neil via Snort-users <[email protected]>
| Newsgroups | gmane.comp.security.ids.snort.general |
|---|---|
| Message-ID | <46884391f8f344fb8930fe1661286ea4@FJDUKEX08.fjdefence.fs.fujitsu.com> |
Hi, We're seeing some issues with Snort 3 and it's handling of SIGUSR1. On a variety of linux distributions (Centos 8, Ubuntu, Alma) using version 3.1.25 and 3.1.27, we see some the following effect: e.g. on the first sigusr1 signal sent, we sometimes see no output or truncated statistics output, then on the second signal we'll see the entire or remaining output for the first signal and then the output for the second signal. Sometimes, it may take many signals before anything comes out. We've configured the journal to allow many lines of output to be received (e.g. on the same systems we've simultaneously sent sigusr1 to 16 instances of snort 2 and the journal shows all 16 processes output) - so we don't think it's the underlying configuration - Rate burst limits in journald.conf are all set off. Overall there's not much being written to the journal - maybe 20 lines a second. We've left different time gaps between the signals and that doesn't seem to affect the output. (see below for an example) It feels like there's some buffering somewhere within the snort process and it only outputs or flushes the output when the snort process reaches some limit. This happens with the snort processes under load or not. Can't see a configuration option in the snort config files to tune this Any suggestions? Thanks [root@centos8stream-minimal ansible]# journalctl _PID=2426806 -S -1m -- Logs begin at Mon 2022-05-16 14:21:07 BST, end at Tue 2022-06-14 10:06:17 BST. -- -- No entries -- [root@centos8stream-minimal ansible]# kill -s SIGUSR1 2426806 [root@centos8stream-minimal ansible]# journalctl _PID=2426806 -S -1m -- Logs begin at Mon 2022-05-16 14:21:07 BST, end at Tue 2022-06-14 10:06:17 BST. -- -- No entries -- [root@centos8stream-minimal ansible]# date Tue Jun 14 10:07:19 BST 2022 [root@centos8stream-minimal ansible]# date Tue Jun 14 10:07:35 BST 2022 [root@centos8stream-minimal ansible]# journalctl _PID=2426806 -S -1m -- Logs begin at Mon 2022-05-16 14:21:07 BST, end at Tue 2022-06-14 10:06:17 BST. -- -- No entries -- [root@centos8stream-minimal ansible]# date Tue Jun 14 10:08:05 BST 2022 [root@centos8stream-minimal ansible]# journalctl _PID=2426806 -S -1m -- Logs begin at Mon 2022-05-16 14:21:07 BST, end at Tue 2022-06-14 10:06:17 BST. -- -- No entries -- [root@centos8stream-minimal ansible]# kill -s SIGUSR1 2426806 [root@centos8stream-minimal ansible]# journalctl _PID=2426806 -S -1m -- Logs begin at Mon 2022-05-16 14:21:07 BST, end at Tue 2022-06-14 10:06:17 BST. -- -- No entries -- [root@centos8stream-minimal ansible]# kill -s SIGUSR1 2426806 [root@centos8stream-minimal ansible]# journalctl _PID=2426806 -S -1m -- Logs begin at Mon 2022-05-16 14:21:07 BST, end at Tue 2022-06-14 10:06:17 BST. -- -- No entries -- [root@centos8stream-minimal ansible]# kill -s SIGUSR1 2426806 [root@centos8stream-minimal ansible]# journalctl _PID=2426806 -S -1m -- Logs begin at Mon 2022-05-16 14:21:07 BST, end at Tue 2022-06-14 10:06:17 BST. -- -- No entries -- [root@centos8stream-minimal ansible]# kill -s SIGUSR1 2426806 [root@centos8stream-minimal ansible]# journalctl _PID=2426806 -S -1m -- Logs begin at Mon 2022-05-16 14:21:07 BST, end at Tue 2022-06-14 10:06:17 BST. -- -- No entries -- [root@centos8stream-minimal ansible]# kill -s SIGUSR1 2426806 [root@centos8stream-minimal ansible]# journalctl _PID=2426806 -S -1m -- Logs begin at Mon 2022-05-16 14:21:07 BST, end at Tue 2022-06-14 10:06:17 BST. -- -- No entries -- [root@centos8stream-minimal ansible]# [root@centos8stream-minimal ansible]# [root@centos8stream-minimal ansible]# [root@centos8stream-minimal ansible]# kill -s SIGUSR1 2426806 [root@centos8stream-minimal ansible]# journalctl _PID=2426806 -S -1m -- Logs begin at Mon 2022-05-16 14:21:07 BST, end at Tue 2022-06-14 10:09:20 BST. -- Jun 14 10:09:20 centos8stream-minimal snort[2426806]: pcre_native: 2724 Jun 14 10:09:20 centos8stream-minimal snort[2426806]: -------------------------------------------------- Jun 14 10:09:20 centos8stream-minimal snort[2426806]: Summary Statistics Jun 14 10:09:20 centos8stream-minimal snort[2426806]: -------------------------------------------------- Jun 14 10:09:20 centos8stream-minimal snort[2426806]: process Jun 14 10:09:20 centos8stream-minimal snort[2426806]: signals: 5 Jun 14 10:09:20 centos8stream-minimal snort[2426806]: ================================================== Jun 14 10:09:20 centos8stream-minimal snort[2426806]: ** caught dump-stats signal Jun 14 10:09:20 centos8stream-minimal snort[2426806]: == dumping stats Jun 14 10:09:20 centos8stream-minimal snort[2426806]: -------------------------------------------------- Jun 14 10:09:20 centos8stream-minimal snort[2426806]: Packet Statistics Jun 14 10:09:20 centos8stream-minimal snort[2426806]: -------------------------------------------------- Jun 14 10:09:20 centos8stream-minimal snort[2426806]: daq Jun 14 10:09:20 centos8stream-minimal snort[2426806]: idle: 2592 Jun 14 10:09:20 centos8stream-minimal snort[2426806]: -------------------------------------------------- Jun 14 10:09:20 centos8stream-minimal snort[2426806]: Module Statistics Jun 14 10:09:20 centos8stream-minimal snort[2426806]: -------------------------------------------------- Jun 14 10:09:20 centos8stream-minimal snort[2426806]: pcre Jun 14 10:09:20 centos8stream-minimal snort[2426806]: pcre_rules: 10917 Jun 14 10:09:20 centos8stream-minimal snort[2426806]: pcre_to_hyper: 8193 Jun 14 10:09:20 centos8stream-minimal snort[2426806]: pcre_native: 2724 Jun 14 10:09:20 centos8stream-minimal snort[2426806]: -------------------------------------------------- Jun 14 10:09:20 centos8stream-minimal snort[2426806]: Summary Statistics Jun 14 10:09:20 centos8stream-minimal snort[2426806]: -------------------------------------------------- Jun 14 10:09:20 centos8stream-minimal snort[2426806]: process Jun 14 10:09:20 centos8stream-minimal snort[2426806]: signals: 6 Jun 14 10:09:20 centos8stream-minimal snort[2426806]: ================================================== Jun 14 10:09:20 centos8stream-minimal snort[2426806]: ** caught dump-stats signal Jun 14 10:09:20 centos8stream-minimal snort[2426806]: == dumping stats Jun 14 10:09:20 centos8stream-minimal snort[2426806]: -------------------------------------------------- Jun 14 10:09:20 centos8stream-minimal snort[2426806]: Packet Statistics Jun 14 10:09:20 centos8stream-minimal snort[2426806]: -------------------------------------------------- Jun 14 10:09:20 centos8stream-minimal snort[2426806]: daq Jun 14 10:09:20 centos8stream-minimal snort[2426806]: idle: 3952 Jun 14 10:09:20 centos8stream-minimal snort[2426806]: -------------------------------------------------- Jun 14 10:09:20 centos8stream-minimal snort[2426806]: Module Statistics Jun 14 10:09:20 centos8stream-minimal snort[2426806]: -------------------------------------------------- Jun 14 10:09:20 centos8stream-minimal snort[2426806]: pcre Jun 14 10:09:20 centos8stream-minimal snort[2426806]: pcre_rules: 10917 Jun 14 10:09:20 centos8stream-minimal snort[2426806]: pcre_to_hyper: 8193 Jun 14 10:09:20 centos8stream-minimal snort[2426806]: pcre_native: 2724 Jun 14 10:09:20 centos8stream-minimal snort[2426806]: -------------------------------------------------- Jun 14 10:09:20 centos8stream-minimal snort[2426806]: Summary Statistics Jun 14 10:09:20 centos8stream-minimal snort[2426806]: -------------------------------------------------- Jun 14 10:09:20 centos8stream-minimal snort[2426806]: process Jun 14 10:09:20 centos8stream-minimal snort[2426806]: signals: 7 Jun 14 10:09:20 centos8stream-minimal snort[2426806]: ================================================== Jun 14 10:09:20 centos8stream-minimal snort[2426806]: ** caught dump-stats signal Jun 14 10:09:20 centos8stream-minimal snort[2426806]: == dumping stats Jun 14 10:09:20 centos8stream-minimal snort[2426806]: -------------------------------------------------- Jun 14 10:09:20 centos8stream-minimal snort[2426806]: Packet Statistics Jun 14 10:09:20 centos8stream-minimal snort[2426806]: -------------------------------------------------- Jun 14 10:09:20 centos8stream-minimal snort[2426806]: daq Jun 14 10:09:20 centos8stream-minimal snort[2426806]: idle: 4208 Jun 14 10:09:20 centos8stream-minimal snort[2426806]: -------------------------------------------------- Jun 14 10:09:20 centos8stream-minimal snort[2426806]: Module Statistics Jun 14 10:09:20 centos8stream-minimal snort[2426806]: -------------------------------------------------- Jun 14 10:09:20 centos8stream-minimal snort[2426806]: pcre Jun 14 10:09:20 centos8stream-minimal snort[2426806]: pcre_rules: 10917 Jun 14 10:09:20 centos8stream-minimal snort[2426806]: pcre_to_hyper: 8193 Jun 14 10:09:20 centos8stream-minimal snort[2426806]: pcre_native: 2724 Jun 14 10:09:20 centos8stream-minimal snort[2426806]: -------------------------------------------------- Jun 14 10:09:20 centos8stream-minimal snort[2426806]: Summary Statistics Jun 14 10:09:20 centos8stream-minimal snort[2426806]: -------------------------------------------------- Jun 14 10:09:20 centos8stream-minimal snort[2426806]: process Jun 14 10:09:20 centos8stream-minimal snort[2426806]: signals: 8 Jun 14 10:09:20 centos8stream-minimal snort[2426806]: ================================================== Jun 14 10:09:20 centos8stream-minimal snort[2426806]: ** caught dump-stats signal Jun 14 10:09:20 centos8stream-minimal snort[2426806]: == dumping stats Jun 14 10:09:20 centos8stream-minimal snort[2426806]: -------------------------------------------------- Jun 14 10:09:20 centos8stream-minimal snort[2426806]: Packet Statistics Jun 14 10:09:20 centos8stream-minimal snort[2426806]: -------------------------------------------------- Jun 14 10:09:20 centos8stream-minimal snort[2426806]: daq Jun 14 10:09:20 centos8stream-minimal snort[2426806]: idle: 4320 Jun 14 10:09:20 centos8stream-minimal snort[2426806]: -------------------------------------------------- Jun 14 10:09:20 centos8stream-minimal snort[2426806]: Module Statistics Jun 14 10:09:20 centos8stream-minimal snort[2426806]: -------------------------------------------------- Jun 14 10:09:20 centos8stream-minimal snort[2426806]: pcre Jun 14 10:09:20 centos8stream-minimal snort[2426806]: pcre_rules: 10917 Jun 14 10:09:20 centos8stream-minimal snort[2426806]: pcre_to_hyper: 8193 Jun 14 10:09:20 centos8stream-minimal snort[2426806]: pcre_native: 2724 Jun 14 10:09:20 centos8stream-minimal snort[2426806]: -------------------------------------------------- Jun 14 10:09:20 centos8stream-minimal snort[2426806]: Summary Statistics Jun 14 10:09:20 centos8stream-minimal snort[2426806]: -------------------------------------------------- Jun 14 10:09:20 centos8stream-minimal snort[2426806]: process Jun 14 10:09:20 centos8stream-minimal snort[2426806]: signals: 9 Jun 14 10:09:20 centos8stream-minimal snort[2426806]: ================================================== Jun 14 10:09:20 centos8stream-minimal snort[2426806]: ** caught dump-stats signal Jun 14 10:09:20 centos8stream-minimal snort[2426806]: == dumping stats Jun 14 10:09:20 centos8stream-minimal snort[2426806]: -------------------------------------------------- Jun 14 10:09:20 centos8stream-minimal snort[2426806]: Packet Statistics Jun 14 10:09:20 centos8stream-minimal snort[2426806]: -------------------------------------------------- Jun 14 10:09:20 centos8stream-minimal snort[2426806]: daq Jun 14 10:09:20 centos8stream-minimal snort[2426806]: idle: 4448 Jun 14 10:09:20 centos8stream-minimal snort[2426806]: -------------------------------------------------- Jun 14 10:09:20 centos8stream-minimal snort[2426806]: Module Statistics Jun 14 10:09:20 centos8stream-minimal snort[2426806]: -------------------------------------------------- Jun 14 10:09:20 centos8stream-minimal snort[2426806]: pcre Jun 14 10:09:20 centos8stream-minimal snort[2426806]: pcre_rules: 10917 Jun 14 10:09:20 centos8stream-minimal snort[2426806]: pcre_to_hyper: 8193 Jun 14 10:09:20 centos8stream-minimal snort[2426806]: pcre_native: 2724 Jun 14 10:09:20 centos8stream-minimal snort[2426806]: -------------------------------------------------- Jun 14 10:09:20 centos8stream-minimal snort[2426806]: Summary Statistics Jun 14 10:09:20 centos8stream-minimal snort[2426806]: -------------------------------------------------- Jun 14 10:09:20 centos8stream-minimal snort[2426806]: process Jun 14 10:09:20 centos8stream-minimal snort[2426806]: signals: 10 Jun 14 10:09:20 centos8stream-minimal snort[2426806]: ================================================== Jun 14 10:09:20 centos8stream-minimal snort[2426806]: ** caught dump-stats signal Jun 14 10:09:20 centos8stream-minimal snort[2426806]: == dumping stats Jun 14 10:09:20 centos8stream-minimal snort[2426806]: -------------------------------------------------- Jun 14 10:09:20 centos8stream-minimal snort[2426806]: Packet Statistics Jun 14 10:09:20 centos8stream-minimal snort[2426806]: -------------------------------------------------- Jun 14 10:09:20 centos8stream-minimal snort[2426806]: daq Jun 14 10:09:20 centos8stream-minimal snort[2426806]: idle: 4576 Jun 14 10:09:20 centos8stream-minimal snort[2426806]: -------------------------------------------------- Jun 14 10:09:20 centos8stream-minimal snort[2426806]: Module Statistics Jun 14 10:09:20 centos8stream-minimal snort[2426806]: -------------------------------------------------- Jun 14 10:09:20 centos8stream-minimal snort[2426806]: pcre Jun 14 10:09:20 centos8stream-minimal snort[2426806]: pcre_rules: 10917 Jun 14 10:09:20 centos8stream-minimal snort[2426806]: pcre_to_hyper: 8193 Jun 14 10:09:20 centos8stream-minimal snort[2426806]: pcre_native: 2724 Jun 14 10:09:20 centos8stream-minimal snort[2426806]: -------------------------------------------------- Jun 14 10:09:20 centos8stream-minimal snort[2426806]: Summary Statistics Jun 14 10:09:20 centos8stream-minimal snort[2426806]: -------------------------------------------------- Jun 14 10:09:20 centos8stream-minimal snort[2426806]: process Jun 14 10:09:20 centos8stream-minimal snort[2426806]: signals: 11 Jun 14 10:09:20 centos8stream-minimal snort[2426806]: ================================================== Jun 14 10:09:20 centos8stream-minimal snort[2426806]: ** caught dump-stats signal Jun 14 10:09:20 centos8stream-minimal snort[2426806]: == dumping stats Unless otherwise stated, this email has been sent from Fujitsu Services Limited (registered in England No 96056); Fujitsu EMEA PLC (registered in England No 2216100) both with registered offices at: 22 Baker Street, London W1U 3BW; PFU (EMEA) Limited, (registered in England No 1578652) registered offices at: Hayes Park Central, Hayes End Road, Hayes, Middlesex, UB4 8FE and Fujitsu Laboratories of Europe Limited (registered in England No. 4153469) 4th Floor, Building 3, Hyde Park Hayes, 11 Millington Road, Hayes,UB3 4AZ This email is only for the use of its intended recipient. Its contents are subject to a duty of confidence and may be privileged. Fujitsu does not guarantee that this email has not been intercepted and amended or that it is virus-free _______________________________________________ Snort-users mailing list [email protected] Go to this URL to change user options or unsubscribe: https://lists.snort.org/mailman/listinfo/snort-users To unsubscribe, send an email to: [email protected] Please visit http://blog.snort.org to stay current on all the latest Snort news! Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette