argus.2.0.6.fixes.1 on OBSD 3.7

[eric]

On Tue, 2005-08-23 at 15:54:33 +1200, Russell Fulton proclaimed...

> 
> Now it keeps dying with memory problems: 
> 
> Aug 23 13:06:29 hihi argus_bpf[27318]: started
> Aug 23 13:30:51 hihi argus_bpf[27318]: ArgusNewFlow() ArgusCalloc error 
> Cannot allocate memory. Aug 23 13:30:51 hihi argus_bpf[27682]: 
> client(/home/argus/data/current) done. 
> The box has 512MB real memory and a GB of swap.  I'm running other linux 
> sensors on this network with less memory.  
> I remember Eric and Peter mentioning kernel memory being an issue with some 
> BSD systems but could not find the posts in the archive.

Hi Russell!

How often is your process dying off? Can you debug it (touch .devel .debug)
in the root directory and build, then it in gdb. You can also run it under
systrace(8) and see if that gives you information.

Everything in obsd can be done in login.conf(5). No kernel compiling is
needed. On our main sensor (about 300Mbps) we only use about 210MB of
resident memory. Granted, we're using gargoyle, but the footprint of argus
seems to only be about 30% larger.