argus.2.0.6.fixes.1 on OBSD 3.7
Peter Van Epp
vanepp at sfu.ca
Tue Aug 23 00:07:04 EDT 2005
On Tue, Aug 23, 2005 at 03:54:33PM +1200, Russell Fulton wrote:
> HI Folks,
> This is my first serious foray into using argus on Open BSD. First
> thing I tripped over was that I got the original 2.0.6 distro from
> qosient and it would not use the -F conf.file. I then remembered
> that there had been a fix version and got that from the /dev/
> directory. I've emailed Carter to say that he really should put the
> fixed version in /pub/ :)
> Now it keeps dying with memory problems:
> Aug 23 13:06:29 hihi argus_bpf: started
> Aug 23 13:30:51 hihi argus_bpf: ArgusNewFlow() ArgusCalloc error
> Cannot allocate memory. Aug 23 13:30:51 hihi argus_bpf:
> client(/home/argus/data/current) done.
> The box has 512MB real memory and a GB of swap. I'm running other linux
> sensors on this network with less memory.
> I remember Eric and Peter mentioning kernel memory being an issue with some
> BSD systems but could not find the posts in the archive.
> BTW I'm using the generic kernel.
The kernel shouldn't be your problem. As I recall (at least on FreeBSD)
the rlimit is 512 megs (so a process can't allocate more than that) and I've
only had problems on the post processing box with 750 megs real and large
perl scripts. I have to admit I check that argus compiles on OpenBSD (which
is often a challange :-)) but haven't run it with a serious load. That actually
sounds like a memory leak (i.e. it isn't releasing freed memory). Your best
bet would probably be compile with debug and try it with -D2 and increase the
debug level til something makes sense :-)
Peter Van Epp / Operations and Technical Support
Simon Fraser University, Burnaby, B.C. Canada
More information about the argus