argus.2.0.6.fixes.1 on OBSD 3.7

[Peter Van Epp]

On Tue, Aug 23, 2005 at 03:54:33PM +1200, Russell Fulton wrote:
> 
> HI Folks,
> 	This is my first serious foray into using argus on Open BSD.  First 
> 	thing I tripped over was that I got the original 2.0.6 distro from 
> 	qosient and it would not use the -F conf.file.  I then remembered 
> 	that there had been a fix version and got that from the /dev/ 
> 	directory.  I've emailed Carter to say that he really should put the 
> 	fixed version in /pub/ :)
> 
> Now it keeps dying with memory problems: 
> 
> Aug 23 13:06:29 hihi argus_bpf[27318]: started
> Aug 23 13:30:51 hihi argus_bpf[27318]: ArgusNewFlow() ArgusCalloc error 
> Cannot allocate memory. Aug 23 13:30:51 hihi argus_bpf[27682]: 
> client(/home/argus/data/current) done. 
> The box has 512MB real memory and a GB of swap.  I'm running other linux 
> sensors on this network with less memory.  
> I remember Eric and Peter mentioning kernel memory being an issue with some 
> BSD systems but could not find the posts in the archive.
> 
> BTW I'm using the generic kernel.
> 
> Russell

	The kernel shouldn't be your problem. As I recall (at least on FreeBSD)
the rlimit is 512 megs (so a process can't allocate more than that) and I've
only had problems on the post processing box with 750 megs real and large 
perl scripts. I have to admit I check that argus compiles on OpenBSD (which 
is often a challange :-)) but haven't run it with a serious load. That actually
sounds like a memory leak (i.e. it isn't releasing freed memory). Your best
bet would probably be compile with debug and try it with -D2 and increase the
debug level til something makes sense :-) 

Peter Van Epp / Operations and Technical Support 
Simon Fraser University, Burnaby, B.C. Canada