Re: Snort 3.1.18.0 on Ubuntu 18 & 20

Hi all,

I didn’t see a reply to this from our end (although I may have missed it), but I can provide a little more information and I just wanted to follow up.

We have recently switched<https://github.com/snort3/snort3/commit/9ac428d8574f4ab8049668783f478ddb453db52f#diff-0c81793d2515c8cd9cfe4f09f1b55f12281ee5bef2df0c2c1735e91bb6a39d3c> from using tcmalloc as our heap manager to jemalloc. One of the main priorities in doing so was process-level, rather than thread-level, memory management. In the previous memory management scheme, all allocations needed to be tracked (previously done by MemoryManager::update_allocations). With these recent changes to our memory management strategy, this is no longer required, as we can simply poll jemalloc’s stats.allocated.

With the way that we were previously using tcmalloc, we were dependent on our internal memory tracking, by means of update_allocations and update_deallocations, and these are no longer present. As such, the tcmalloc build no longer provides internal memory management (see src/memory/dev_notes.txt for more info on this).

To answer the question in the below email, all that should be required now is --enable-jemalloc
Enabling tcmalloc is not required, and, for most use-cases, no longer recommended.

I can see that, in the setup guide for Ubuntu 18 and 20, it does (incorrectly) state to use both. I will look into getting this fixed – thanks for pointing this out.

Thanks,
Michael

From: Snort-users <[email protected]> on behalf of Michael Steele <[email protected]>
Date: Wednesday, March 22, 2023 at 6:20 PM
To: Vitalii Serhiiovych Horbatov -X (vhorbato - SOFTSERVE INC at Cisco) <[email protected]>
Cc: [email protected] <[email protected]>
Subject: Re: [Snort-users] Snort 3.1.18.0 on Ubuntu 18 & 20
There is an issue with the line below:

./configure_cmake.sh --prefix=/usr/local --enable-tcmalloc --enable-jemalloc

It refuses to install with the above line and the output is below:

morpheus@Morpheus:~/snort_src/snort3-3.1.57.0$<mailto:morpheus@Morpheus:~/snort_src/snort3-3.1.57.0$> ./configure_cmake.sh --prefix=/usr/local --enable-tcmalloc --enable-jemalloc
--enable-jemalloc and --enable-tcmalloc are mutually exclusive; enable at most one
morpheus@Morpheus:

I revised the line to the below and it completed but I’m unsure of the ramifications by omitting the --enable-jemalloc

./configure_cmake.sh --prefix=/usr/local --enable-tcmalloc

Not sure if I should run the two lines below to compensate for the error:

./configure_cmake.sh --prefix=/usr/local --enable-tcmalloc
./configure_cmake.sh --prefix=/usr/local --enable- jemalloc

Thanks…

From: Vitalii Serhiiovych Horbatov -X (vhorbato - SOFTSERVE INC at Cisco) <[email protected]>
Sent: Tuesday, March 21, 2023 6:19 AM
To: Michael Steele <[email protected]>
Cc: [email protected]
Subject: Re: [Snort-users] Snort 3.1.18.0 on Ubuntu 18 & 20


Hi Michael, could you please attach your config and full log message(using systemctl -l status snort3 for example)?

Thanks,
Vitalii!

From: Snort-users <[email protected]<mailto:[email protected]>> on behalf of Michael Steele <[email protected]<mailto:[email protected]>>
Date: Monday, 20 March 2023, 15:15
To: [email protected]<mailto:[email protected]> <[email protected]<mailto:[email protected]>>
Subject: [Snort-users] Snort 3.1.18.0 on Ubuntu 18 & 20


I’m getting to the section “Enable the Snort systemD service and start it:” in the guide and the error below happens. Not sure what I did wrong but the install has been good up to this poing.

morpheus@Morpheus:~/snort_src/pulledpork3$ sudo systemctl enable snort3
morpheus@Morpheus:~/snort_src/pulledpork3$ sudo service snort3 start
morpheus@Morpheus:~/snort_src/pulledpork3$ service snort3 status
● snort3.service - Snort3 NIDS Daemon
     Loaded: loaded (/lib/systemd/system/snort3.service; enabled; vendor preset: enabled)
     Active: failed (Result: signal) since Sun 2023-03-19 18:53:56 EDT; 5s ago
    Process: 1666 ExecStart=/usr/local/bin/snort -c /usr/local/etc/snort/snort.lua -s 65535 -k none -l /var/log/snort ->
   Main PID: 1666 (code=killed, signal=ABRT)
        CPU: 8.642s

Mar 19 18:53:56 Morpheus snort[1666]:   #9 0x564aec1a5844 in _ZN5ACRun7executeER8AnalyzerPPv+0x14 (/usr/local/bin/snort>
Mar 19 18:53:56 Morpheus snort[1666]:   #10 0x564aec1a4a25 in _ZN8Analyzer14handle_commandEv+0xa5 (/usr/local/bin/snort>
Mar 19 18:53:56 Morpheus snort[1666]:   #11 0x564aec1a504d in _ZN8Analyzer7analyzeEv+0x3d (/usr/local/bin/snort @0x564a>
Mar 19 18:53:56 Morpheus snort[1666]:   #12 0x564aec1a5215 in _ZN8AnalyzerclEP7Swappert+0xb5 (/usr/local/bin/snort @0x5>
Mar 19 18:53:56 Morpheus snort[1666]:   #13 0x7f5ae8d76de4 in _ZNKSt10error_code23default_error_conditionEv+0x34 (/lib/>
Mar 19 18:53:56 Morpheus snort[1666]:   #14 0x7f5ae9a3a609 in start_thread+0xd9 (/lib/x86_64-linux-gnu/libpthread.so.0 >
Mar 19 18:53:56 Morpheus snort[1666]:   #15 0x7f5ae8a61133 in clone+0x43 (/lib/x86_64-linux-gnu/libc.so.6 @0x7f5ae89420>
Mar 19 18:53:56 Morpheus systemd[1]: snort3.service: Main process exited, code=killed, status=6/ABRT
Mar 19 18:53:56 Morpheus systemd[1]: snort3.service: Failed with result 'signal'.
Mar 19 18:53:56 Morpheus systemd[1]: snort3.service: Consumed 8.642s CPU time.

morpheus@Morpheus:

Thanks…

_______________________________________________
Snort-users mailing list
[email protected]
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

	To unsubscribe, send an email to:
	[email protected]

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette