Crash reports

[gboone]

Hi I have a crash report.

Memory is 1.5GB with 3GB of swap.

Backtrace:

db:0:kdb.enter.default>  bt
Tracing pid 11 tid 100004 td 0xfffff80004188740
kdb_enter() at kdb_enter+0x37/frame 0xfffffe0018537800
vpanic() at vpanic+0x197/frame 0xfffffe0018537850
panic() at panic+0x43/frame 0xfffffe00185378b0
trap_fatal() at trap_fatal+0x391/frame 0xfffffe0018537910
trap_pfault() at trap_pfault+0x4f/frame 0xfffffe0018537960
trap() at trap+0x286/frame 0xfffffe0018537a70
calltrap() at calltrap+0x8/frame 0xfffffe0018537a70
--- trap 0xc, rip = 0xffffffff80da98f4, rsp = 0xfffffe0018537b40, rbp = 0xfffffe0018537ba0 ---
callout_process() at callout_process+0x184/frame 0xfffffe0018537ba0
handleevents() at handleevents+0x188/frame 0xfffffe0018537be0
cpu_activeclock() at cpu_activeclock+0x71/frame 0xfffffe0018537c10
cpu_idle() at cpu_idle+0xa8/frame 0xfffffe0018537c30
sched_idletd() at sched_idletd+0x326/frame 0xfffffe0018537cf0
fork_exit() at fork_exit+0x7e/frame 0xfffffe0018537d30
fork_trampoline() at fork_trampoline+0xe/frame 0xfffffe0018537d30
--- trap 0, rip = 0, rsp = 0, rbp = 0 ---

I also notice this after a reboot in the textdump:

<3>pid 43372 (php), jid 0, uid 0, was killed: out of swap space
<3>pid 99443 (snort), jid 0, uid 0, was killed: out of swap space
<3>pid 885 (snort), jid 0, uid 0, was killed: out of swap space
<3>pid 54399 (snort), jid 0, uid 0, was killed: out of swap space

and this leads to another reboot where snort is listed again as being killed which leads to trap 12.

Fatal trap 12: page fault while in kernel mode
cpuid = 1; apic id = 01
fault virtual address	= 0x11
fault code		= supervisor read data, page not present
instruction pointer	= 0x20:0xffffffff80da98f4
stack pointer	        = 0x28:0xfffffe0018537b40
frame pointer	        = 0x28:0xfffffe0018537ba0
code segment		= base 0x0, limit 0xfffff, type 0x1b
			= DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags	= resume, IOPL = 0
current process		= 11 (idle: cpu1)
trap number		= 12
panic: page fault
cpuid = 1
time = 1660334956
KDB: enter: panic

[stephenw10]

Is it actually using swap space at any time?

If you check the memory usage in Status > Monitoring do you see free memory being exhausted?

You shouldn't be seeing those swap space errors.

Steve

[gboone]

@stephenw10

It does sometimes use swap, but normally not at all.

Here is a memory chart for today.

It crashed around 16:10 when the active is seen as spiking from having only been around 2%.

I'm not sure why it crashed. Nothing unusual for in the traffic or processing.

Immediately before the reboot was an hourly pfBlockerNG update, but here is what it shows (newest to oldest):

Spoiler

Aug 12 16:10:00 kernel lo0: link state changed to UP
Aug 12 16:10:00 kernel smbus0: <System Management Bus> on intsmb0
Aug 12 16:10:00 kernel intsmb0: intr IRQ 9 enabled revision 0
Aug 12 16:10:00 kernel intsmb0: <Intel PIIX4 SMBUS Interface> irq 9 at device 1.3 on pci0
Aug 12 16:10:00 kernel Hypervisor: Origin = "KVMKVMKVM"
Aug 12 16:10:00 kernel AMD Features2=0x3<LAHF,CMP>
Aug 12 16:10:00 kernel AMD Features=0x20100800<SYSCALL,NX,LM>
Aug 12 16:10:00 kernel Features2=0x80202001<SSE3,CX16,x2APIC,HV>
Aug 12 16:10:00 kernel Features=0x178bfbff<FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,CLFLUSH,MMX,FXSR,SSE,SSE2,HTT>
Aug 12 16:10:00 kernel Origin="AuthenticAMD" Id=0xf61 Family=0xf Model=0x6 Stepping=1
Aug 12 16:10:00 kernel CPU: Common KVM processor (4018.73-MHz K8-class CPU)
Aug 12 16:10:00 kernel WARNING: / was not properly dismounted
Aug 12 16:10:00 kernel mountroot: waiting for device /dev/ufsid/5bb8da0df776c807...
Aug 12 16:10:00 kernel da0: 8192MB (16777216 512 byte sectors)
Aug 12 16:10:00 kernel da0: Command Queueing enabled
Aug 12 16:10:00 kernel da0: 300.000MB/s transfers
Aug 12 16:10:00 kernel da0: <QEMU QEMU HARDDISK 2.5+> Fixed Direct Access SPC-3 SCSI device
Aug 12 16:10:00 kernel da0 at vtscsi0 bus 0 scbus2 target 0 lun 0
Aug 12 16:10:00 kernel cd0: Attempt to query device size failed: NOT READY, Medium not present
Aug 12 16:10:00 kernel cd0: 16.700MB/s transfers (WDMA2, ATAPI 12bytes, PIO 65534bytes)
Aug 12 16:10:00 kernel cd0: Serial Number QM00003
Aug 12 16:10:00 kernel cd0: <QEMU QEMU DVD-ROM 2.5+> Removable CD-ROM SCSI device
Aug 12 16:10:00 kernel cd0 at ata1 bus 0 scbus1 target 0 lun 0
Aug 12 16:10:00 kernel Root mount waiting for: CAM
Aug 12 16:10:00 kernel Root mount waiting for: CAM
Aug 12 16:10:00 kernel Root mount waiting for: CAM
Aug 12 16:10:00 kernel Root mount waiting for: CAM
Aug 12 16:10:00 kernel Root mount waiting for: CAM
Aug 12 16:10:00 kernel Root mount waiting for: CAM
Aug 12 16:10:00 kernel Root mount waiting for: CAM
Aug 12 16:10:00 kernel Root mount waiting for: CAM
Aug 12 16:10:00 kernel uhid0: <QEMU QEMU USB Tablet, class 0/0, rev 2.00/0.00, addr 2> on usbus0
Aug 12 16:10:00 kernel uhid0 on uhub0
Aug 12 16:10:00 kernel ugen0.2: <QEMU QEMU USB Tablet> at usbus0
Aug 12 16:10:00 kernel Root mount waiting for: CAM usbus0
Aug 12 16:10:00 kernel uhub0: 2 ports with 2 removable, self powered
Aug 12 16:10:00 kernel Root mount waiting for: CAM usbus0
Aug 12 16:10:00 kernel Trying to mount root from ufs:/dev/ufsid/5bb8da0df776c807 [rw]...
Aug 12 16:10:00 kernel uhub0: <Intel UHCI root HUB, class 9/0, rev 1.00/1.00, addr 1> on usbus0
Aug 12 16:10:00 kernel ugen0.1: <Intel UHCI root HUB> at usbus0
Aug 12 16:10:00 kernel Timecounters tick every 10.000 msec
Aug 12 16:10:00 kernel fdc0: No FDOUT register!
Aug 12 16:10:00 kernel Event timer "i8254" frequency 1193182 Hz quality 100
Aug 12 16:10:00 kernel Timecounter "i8254" frequency 1193182 Hz quality 0
Aug 12 16:10:00 kernel attimer0: <AT timer> at port 0x40 on isa0
Aug 12 16:10:00 kernel vga0: <Generic ISA VGA> at port 0x3c0-0x3df iomem 0xa0000-0xbffff pnpid PNP0900 on isa0
Aug 12 16:10:00 kernel orm0: <ISA Option ROM> at iomem 0xe8000-0xeffff pnpid ORM0000 on isa0
Aug 12 16:10:00 kernel device_attach: fdc0 attach returned 6
Aug 12 16:10:00 kernel fdc0: does not respond
Aug 12 16:10:00 kernel fdc0: <floppy drive controller (FDE)> port 0x3f2-0x3f5,0x3f7 irq 6 drq 2 on acpi0
Aug 12 16:10:00 kernel psm0: model IntelliMouse Explorer, device ID 4
Aug 12 16:10:00 kernel WARNING: Device "psm" is Giant locked and may be deleted before FreeBSD 14.0.
Aug 12 16:10:00 kernel psm0: [GIANT-LOCKED]
Aug 12 16:10:00 kernel psm0: <PS/2 Mouse> irq 12 on atkbdc0
Aug 12 16:10:00 kernel atkbd0: [GIANT-LOCKED]
Aug 12 16:10:00 kernel kbd0 at atkbd0
Aug 12 16:10:00 kernel atkbd0: <AT Keyboard> irq 1 on atkbdc0
Aug 12 16:10:00 kernel atkbdc0: <Keyboard controller (i8042)> port 0x60,0x64 irq 1 on acpi0
Aug 12 16:10:00 kernel acpi_syscontainer3: <System Container> port 0xae00-0xae17 on acpi0
Aug 12 16:10:00 kernel acpi_syscontainer2: <System Container> port 0xafe0-0xafe3 on acpi0
Aug 12 16:10:00 kernel acpi_syscontainer1: <System Container> port 0xaf00-0xaf0b on acpi0
Aug 12 16:10:00 kernel acpi_syscontainer0: <System Container> on acpi0
Aug 12 16:10:00 kernel pci2: <ACPI PCI bus> on pcib2
Aug 12 16:10:00 kernel pcib2: <ACPI PCI-PCI bridge> mem 0xfeb17000-0xfeb170ff irq 11 at device 31.0 on pci0
Aug 12 16:10:00 kernel pci1: <ACPI PCI bus> on pcib1
Aug 12 16:10:00 kernel pcib1: <ACPI PCI-PCI bridge> mem 0xfeb16000-0xfeb160ff irq 10 at device 30.0 on pci0
Aug 12 16:10:00 kernel 000.000770 [ 450] vtnet_netmap_attach vtnet attached txq=1, txd=256 rxq=1, rxd=128
Aug 12 16:10:00 kernel vtnet3: netmap queues/slots: TX 1/256, RX 1/128
Aug 12 16:10:00 kernel vtnet3: Ethernet address: 1e:d3:f3:c4:25:16
Aug 12 16:10:00 kernel vtnet3: <VirtIO Networking Adapter> on virtio_pci5
Aug 12 16:10:00 kernel virtio_pci5: <VirtIO PCI Network adapter> port 0xe100-0xe11f mem 0xfeb15000-0xfeb15fff,0xfe414000-0xfe417fff irq 10 at device 21.0 on pci0
Aug 12 16:10:00 kernel 000.000769 [ 450] vtnet_netmap_attach vtnet attached txq=1, txd=256 rxq=1, rxd=128
Aug 12 16:10:00 kernel vtnet2: netmap queues/slots: TX 1/256, RX 1/128
Aug 12 16:10:00 kernel vtnet2: Ethernet address: 4e:9f:8c:e7:f8:bc
Aug 12 16:10:00 kernel vtnet2: <VirtIO Networking Adapter> on virtio_pci4
Aug 12 16:10:00 kernel virtio_pci4: <VirtIO PCI Network adapter> port 0xe0e0-0xe0ff mem 0xfeb14000-0xfeb14fff,0xfe410000-0xfe413fff irq 11 at device 20.0 on pci0
Aug 12 16:10:00 kernel 000.000768 [ 450] vtnet_netmap_attach vtnet attached txq=1, txd=256 rxq=1, rxd=128
Aug 12 16:10:00 kernel vtnet1: netmap queues/slots: TX 1/256, RX 1/128
Aug 12 16:10:00 kernel vtnet1: Ethernet address: 96:6b:61:eb:9b:a2
Aug 12 16:10:00 kernel vtnet1: <VirtIO Networking Adapter> on virtio_pci3
Aug 12 16:10:00 kernel virtio_pci3: <VirtIO PCI Network adapter> port 0xe0c0-0xe0df mem 0xfeb13000-0xfeb13fff,0xfe40c000-0xfe40ffff irq 11 at device 19.0 on pci0
Aug 12 16:10:00 kernel 000.000767 [ 450] vtnet_netmap_attach vtnet attached txq=1, txd=256 rxq=1, rxd=128
Aug 12 16:10:00 kernel vtnet0: netmap queues/slots: TX 1/256, RX 1/128
Aug 12 16:10:00 kernel vtnet0: Ethernet address: 62:d3:d7:11:2b:30
Aug 12 16:10:00 kernel vtnet0: <VirtIO Networking Adapter> on virtio_pci2
Aug 12 16:10:00 kernel virtio_pci2: <VirtIO PCI Network adapter> port 0xe0a0-0xe0bf mem 0xfeb12000-0xfeb12fff,0xfe408000-0xfe40bfff irq 10 at device 18.0 on pci0
Aug 12 16:10:00 kernel vtscsi0: <VirtIO SCSI Adapter> on virtio_pci1
Aug 12 16:10:00 kernel virtio_pci1: <VirtIO PCI SCSI adapter> port 0xe040-0xe07f mem 0xfeb11000-0xfeb11fff,0xfe404000-0xfe407fff irq 10 at device 5.0 on pci0
Aug 12 16:10:00 kernel vtballoon0: <VirtIO Balloon Adapter> on virtio_pci0
Aug 12 16:10:00 kernel virtio_pci0: <VirtIO PCI Balloon adapter> port 0xe000-0xe03f mem 0xfe400000-0xfe403fff irq 11 at device 3.0 on pci0
Aug 12 16:10:00 kernel vgapci0: Boot video device
Aug 12 16:10:00 kernel vgapci0: <VGA-compatible display> mem 0xfd000000-0xfdffffff,0xfeb10000-0xfeb10fff at device 2.0 on pci0
Aug 12 16:10:00 kernel pci0: <bridge> at device 1.3 (no driver attached)
Aug 12 16:10:00 kernel usbus0: 12Mbps Full Speed USB v1.0
Aug 12 16:10:00 kernel usbus0 on uhci0
Aug 12 16:10:00 kernel uhci0: <Intel 82371SB (PIIX3) USB controller> port 0xe080-0xe09f irq 11 at device 1.2 on pci0
Aug 12 16:10:00 kernel ata1: <ATA channel> at channel 1 on atapci0
Aug 12 16:10:00 kernel ata0: <ATA channel> at channel 0 on atapci0
Aug 12 16:10:00 kernel atapci0: <Intel PIIX3 WDMA2 controller> port 0x1f0-0x1f7,0x3f6,0x170-0x177,0x376,0xe120-0xe12f at device 1.1 on pci0
Aug 12 16:10:00 kernel isa0: <ISA bus> on isab0
Aug 12 16:10:00 kernel isab0: <PCI-ISA bridge> at device 1.0 on pci0
Aug 12 16:10:00 kernel pci0: <ACPI PCI bus> on pcib0
Aug 12 16:10:00 kernel pcib0: <ACPI Host-PCI bridge> port 0xcf8-0xcff on acpi0
Aug 12 16:10:00 kernel acpi_timer0: <24-bit timer at 3.579545MHz> port 0x608-0x60b on acpi0
Aug 12 16:10:00 kernel Timecounter "ACPI-fast" frequency 3579545 Hz quality 900
Aug 12 16:10:00 kernel Timecounter "HPET" frequency 100000000 Hz quality 950
Aug 12 16:10:00 kernel hpet0: <High Precision Event Timer> iomem 0xfed00000-0xfed003ff on acpi0
Aug 12 16:10:00 kernel Event timer "RTC" frequency 32768 Hz quality 0
Aug 12 16:10:00 kernel atrtc0: registered as a time-of-day clock, resolution 1.000000s
Aug 12 16:10:00 kernel atrtc0: <AT realtime clock> port 0x70-0x77 irq 8 on acpi0
Aug 12 16:10:00 kernel cpu0: <ACPI CPU> on acpi0
Aug 12 16:10:00 kernel acpi0: Power Button (fixed)
Aug 12 16:10:00 kernel acpi0: <BOCHS BXPC> on motherboard
Aug 12 16:10:00 kernel cryptosoft0: <software crypto> on motherboard
Aug 12 16:10:00 kernel kvmclock0: registered as a time-of-day clock, resolution 0.000001s
Aug 12 16:10:00 kernel Timecounter "kvmclock" frequency 1000000000 Hz quality 975
Aug 12 16:10:00 kernel kvmclock0: <KVM paravirtual clock> on motherboard
Aug 12 16:10:00 kernel vtvga0: <VT VGA driver> on motherboard
Aug 12 16:10:00 kernel nexus0
Aug 12 16:10:00 kernel mlx5en: Mellanox Ethernet driver 3.6.0 (December 2020)
Aug 12 16:10:00 kernel WARNING: Device "spkr" is Giant locked and may be deleted before FreeBSD 14.0.
Aug 12 16:10:00 kernel [ath_hal] loaded
Aug 12 16:10:00 kernel kbd1 at kbdmux0
Aug 12 16:10:00 kernel WARNING: Device "kbd" is Giant locked and may be deleted before FreeBSD 14.0.
Aug 12 16:10:00 kernel module_register_init: MOD_LOAD (vesa, 0xffffffff8140a210, 0) error 19
Aug 12 16:10:00 kernel WARNING: Device "pci" is Giant locked and may be deleted before FreeBSD 14.0.
Aug 12 16:10:00 kernel 000.000018 [4344] netmap_init netmap: loaded module
Aug 12 16:10:00 kernel WARNING: Device "g_ctl" is Giant locked and may be deleted before FreeBSD 14.0.
Aug 12 16:10:00 kernel module_register_init: MOD_LOAD (iwi_monitor_fw, 0xffffffff80760b50, 0) error 1
Aug 12 16:10:00 kernel iwi_monitor: If you agree with the license, set legal.intel_iwi.license_ack=1 in /boot/loader.conf.
Aug 12 16:10:00 kernel iwi_monitor: You need to read the LICENSE file in /usr/share/doc/legal/intel_iwi.LICENSE.
Aug 12 16:10:00 kernel module_register_init: MOD_LOAD (iwi_ibss_fw, 0xffffffff80760aa0, 0) error 1
Aug 12 16:10:00 kernel iwi_ibss: If you agree with the license, set legal.intel_iwi.license_ack=1 in /boot/loader.conf.
Aug 12 16:10:00 kernel iwi_ibss: You need to read the LICENSE file in /usr/share/doc/legal/intel_iwi.LICENSE.
Aug 12 16:10:00 kernel module_register_init: MOD_LOAD (iwi_bss_fw, 0xffffffff807609f0, 0) error 1
Aug 12 16:10:00 kernel iwi_bss: If you agree with the license, set legal.intel_iwi.license_ack=1 in /boot/loader.conf.
Aug 12 16:10:00 kernel iwi_bss: You need to read the LICENSE file in /usr/share/doc/legal/intel_iwi.LICENSE.
Aug 12 16:10:00 kernel module_register_init: MOD_LOAD (ipw_monitor_fw, 0xffffffff80739160, 0) error 1
Aug 12 16:10:00 kernel ipw_monitor: If you agree with the license, set legal.intel_ipw.license_ack=1 in /boot/loader.conf.
Aug 12 16:10:00 kernel ipw_monitor: You need to read the LICENSE file in /usr/share/doc/legal/intel_ipw.LICENSE.
Aug 12 16:10:00 kernel module_register_init: MOD_LOAD (ipw_ibss_fw, 0xffffffff807390b0, 0) error 1
Aug 12 16:10:00 kernel ipw_ibss: If you agree with the license, set legal.intel_ipw.license_ack=1 in /boot/loader.conf.
Aug 12 16:10:00 kernel ipw_ibss: You need to read the LICENSE file in /usr/share/doc/legal/intel_ipw.LICENSE.
Aug 12 16:10:00 kernel module_register_init: MOD_LOAD (ipw_bss_fw, 0xffffffff80739000, 0) error 1
Aug 12 16:10:00 kernel ipw_bss: If you agree with the license, set legal.intel_ipw.license_ack=1 in /boot/loader.conf.
Aug 12 16:10:00 kernel ipw_bss: You need to read the LICENSE file in /usr/share/doc/legal/intel_ipw.LICENSE.
Aug 12 16:10:00 kernel random: entropy device external interface
Aug 12 16:10:00 kernel wlan: mac acl policy registered
Aug 12 16:10:00 kernel Launching APs: 1
Aug 12 16:10:00 kernel ioapic0 <Version 1.1> irqs 0-23 on motherboard
Aug 12 16:10:00 kernel random: unblocking device.
Aug 12 16:10:00 kernel FreeBSD/SMP: 1 package(s) x 2 core(s)
Aug 12 16:10:00 kernel FreeBSD/SMP: Multiprocessor System Detected: 2 CPUs
Aug 12 16:10:00 kernel ACPI APIC Table: <BOCHS BXPC >
Aug 12 16:10:00 kernel Event timer "LAPIC" quality 100
Aug 12 16:10:00 kernel avail memory = 2019106816 (1925 MB)
Aug 12 16:10:00 kernel real memory = 2147483648 (2048 MB)
Aug 12 16:10:00 kernel Hypervisor: Origin = "KVMKVMKVM"
Aug 12 16:10:00 kernel AMD Features2=0x3<LAHF,CMP>
Aug 12 16:10:00 kernel AMD Features=0x20100800<SYSCALL,NX,LM>
Aug 12 16:10:00 kernel Features2=0x80202001<SSE3,CX16,x2APIC,HV>
Aug 12 16:10:00 kernel Features=0x1783fbff<FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,MMX,FXSR,SSE,SSE2,HTT>
Aug 12 16:10:00 kernel Origin="AuthenticAMD" Id=0xf61 Family=0xf Model=0x6 Stepping=1
Aug 12 16:10:00 kernel CPU: Common KVM processor (4018.73-MHz K8-class CPU)
Aug 12 16:10:00 kernel VT(vga): text 80x25
Aug 12 16:10:00 kernel FreeBSD clang version 10.0.1 (git@github.com:llvm/llvm-project.git llvmorg-10.0.1-0-gef32c611aa2)
Aug 12 16:10:00 kernel FreeBSD 12.3-STABLE RELENG_2_6_0-n226742-1285d6d205f pfSense amd64
Aug 12 16:10:00 kernel FreeBSD is a registered trademark of The FreeBSD Foundation.
Aug 12 16:10:00 kernel The Regents of the University of California. All rights reserved.
Aug 12 16:10:00 kernel Copyright (c) 1979, 1980, 1983, 1986, 1988, 1989, 1991, 1992, 1993, 1994
Aug 12 16:10:00 kernel Copyright (c) 1992-2021 The FreeBSD Project.
Aug 12 16:10:00 kernel ---<<BOOT>>---
Aug 12 16:10:00 kernel KDB: enter: panic
Aug 12 16:10:00 kernel time = 1660334956
Aug 12 16:10:00 kernel cpuid = 1
Aug 12 16:10:00 kernel panic: page fault
Aug 12 16:10:00 kernel trap number = 12
Aug 12 16:10:00 kernel current process = 11 (idle: cpu1)
Aug 12 16:10:00 kernel processor eflags = resume, IOPL = 0
Aug 12 16:10:00 kernel = DPL 0, pres 1, long 1, def32 0, gran 1
Aug 12 16:10:00 kernel code segment = base 0x0, limit 0xfffff, type 0x1b
Aug 12 16:10:00 kernel frame pointer = 0x28:0xfffffe0018537ba0
Aug 12 16:10:00 kernel stack pointer = 0x28:0xfffffe0018537b40
Aug 12 16:10:00 kernel instruction pointer = 0x20:0xffffffff80da98f4
Aug 12 16:10:00 kernel fault code = supervisor read data, page not present
Aug 12 16:10:00 kernel fault virtual address = 0x11
Aug 12 16:10:00 kernel cpuid = 1; apic id = 01
Aug 12 16:10:00 kernel Fatal trap 12: page fault while in kernel mode
Aug 12 16:10:00 kernel kernel trap 12 with interrupts disabled
Aug 12 16:10:00 syslogd kernel boot file is /boot/kernel/kernel
Aug 12 16:00:00 check_reload_status 388 Syncing firewall
Aug 12 16:00:00 php 94421 /usr/local/www/pfblockerng/pfblockerng.php: Configuration Change: (system): pfBlockerNG: saving DNSBL changes
Aug 12 16:00:00 php 94421 [pfBlockerNG] Starting cron process.

[stephenw10]

If you're using swap at all that's bad. Performance will be dramatically worse. You probably need more RAM or fewer lists and signatures loaded in pfBlocker/Snort.

Out of swap space errors like that can also happen if the OS can no longer access the swap partition like if the drive is failing. However the fact it's recording the crash report suggests that isn't the case.

Steve

[gboone]

@stephenw10
I put the swap there for emergencies, but it's really never used. I can increase the memory.

I wonder, is there a way to delay the starting of snort? Because it all works eventually without any intervention. (Obviously the crash didn't think so) It seems to be too much going on at startup.

EDIT: Although, now that I think of it, I'm not sure I want Snort off at all.

Thanks for your help! I will bump the memory.