SG-3100 Reboots after FW Rule hits 1TB

jimp

If there is one stored it will show on the dashboard, so looking around for one is unlikely to show anything that isn't displayed in the GUI. That said, they are normally stored in /var/crash though I don't think the 3100 is setup to store crash dumps as it doesn't have swap space configured on the SSD.

The console would be the most likely place for it to log any relevant crash messages when it happens.

styxl

@jimp ok, i just checked and the directory is empty. will wait for it to happen again, in the meantime i have disabled SNORT, is there a way to switch crash logs on 3100?

jimp

There aren't any options to control crash dumps, what is possible is on by default. So if you have something connected to the serial console logging the output that should get any relevant messages when it happens.

Rico

@styxl said in SG-3100 Reboots after FW Rule hits 1TB:

it will take weeks to reach 1TB

fetch -o /dev/null http://speedtest.belwue.net/1000G

-Rico

Rico

Just checked my SG-3100s, don't have one with 1TB traffic in one Rule atm.
But my XG-7100....

-Rico

styxl

@jimp ok

styxl

@Rico hehehehe i might try this

NOCling

No Problem here, SG-3100 runs fine:

styxl

i found the issue, SNORT was crashing and locking up the device, after removing and re-installing the package it works fine now.

stephenw10

Logs filled the filesystem?

styxl

@stephenw10 not that i can see, i think there was some kind of exception caused by SNORT that used up memory, i realized i hadnt updated my SNORT package in months

SteveITS

We've got one at 14 TB.

chrcoluk

not same hardware but 1.72 TB on a rule.

Burner27

Whenever I had Snort installed on my SG 3100, it would always cause spontaneous reboots no matter what package version I used. Not sure if it was the way I had it configured, but even with basic rule sets, it would still crash. I have since removed it and have no further issues with reboots.