pfSense has detected a crash report or programming bug.

markchen

Got the below crash report:

Crash report begins. Anonymous machine information:

arm64
11.2-RELEASE-p6
FreeBSD 11.2-RELEASE-p6 #15 ed5153fb2b9(factory-RELENG_2_4_4): Wed Dec 12 14:53:40 EST 2018 root@buildbot2.nyi.netgate.com:/build/factory-crossbuild-244/obj/aarch64/upm8hD25/arm64.aarch64/build/factory-crossbuild-244/pfSense/tmp/FreeBSD-src/sys/pfSens

Crash report details:

PHP Errors:
[26-Mar-2019 20:02:40 America/Los_Angeles] PHP Fatal error: Allowed memory size of 536870912 bytes exhausted (tried to allocate 4595177096 bytes) in /usr/local/www/suricata/suricata_logs_browser.php on line 54

No FreeBSD crash data found.[0_1553659020600_PHP_errors.log](Uploading 100%)

Derelict

You tried to view a suricata log in the web gui log browser but PHP ran out of memory trying to render it.

You'll need to figure out how to make the logs smaller or find another way to view them such as an external log server, grepping what you're looking for in the shell, etc.

markchen

Thank you for the information.

bmeeks

@markchen
For now both Suricata and Snort simply dump the contents of a given log into a PHP data variable and then print the contents of the variable out to the browser. When the log files are huge, this operation exhausts the available PHP memory in the session.

For now, as @Derelict mentioned, reduce the size of the logs by turning on the log size limiting and rotation features under LOGS MGMT. Keep the max log file sizes to the defaults or only a little larger.

I'm looking at a future update in the LOGS VIEW code that would output the log data in a series of smaller data blocks.