Snort, S5: Pruned 2 sessions from cache for memcap. 292 scbs remain

trumee

Hello,

I am running the latest snort 4.1.2_2 release. I am getting a bunch of messages in the log,

Jan 2 19:34:31 	snort 	99033 	S5: Pruned 1 sessions from cache for memcap. 389 scbs remain. memcap: 8387565/8388608 (suppressed 361 times in the last 61 seconds).
Jan 2 19:33:31 	snort 	99033 	S5: Pruned 2 sessions from cache for memcap. 743 scbs remain. memcap: 8387767/8388608 (suppressed 10 times in the last 194 seconds).

Any idea what is causing this?

Thanks

bmeeks

@trumee said in Snort, S5: Pruned 2 sessions from cache for memcap. 292 scbs remain:

Hello,

I am running the latest snort 4.1.2_2 release. I am getting a bunch of messages in the log,

Jan 2 19:34:31 	snort 	99033 	S5: Pruned 1 sessions from cache for memcap. 389 scbs remain. memcap: 8387565/8388608 (suppressed 361 times in the last 61 seconds).
Jan 2 19:33:31 	snort 	99033 	S5: Pruned 2 sessions from cache for memcap. 743 scbs remain. memcap: 8387767/8388608 (suppressed 10 times in the last 194 seconds).

Any idea what is causing this?

Thanks

Here are some links I found with a quick Google search using the terms "snort stream pruned sessions from cache for memcap". The first link is from the Snort mailing list, and it appears to have your best answer in the third reply in that thread.