Snort, S5: Pruned 2 sessions from cache for memcap. 292 scbs remain
-
Hello,
I am running the latest snort 4.1.2_2 release. I am getting a bunch of messages in the log,
Jan 2 19:34:31 snort 99033 S5: Pruned 1 sessions from cache for memcap. 389 scbs remain. memcap: 8387565/8388608 (suppressed 361 times in the last 61 seconds). Jan 2 19:33:31 snort 99033 S5: Pruned 2 sessions from cache for memcap. 743 scbs remain. memcap: 8387767/8388608 (suppressed 10 times in the last 194 seconds).
Any idea what is causing this?
Thanks
-
@trumee said in Snort, S5: Pruned 2 sessions from cache for memcap. 292 scbs remain:
Hello,
I am running the latest snort 4.1.2_2 release. I am getting a bunch of messages in the log,
Jan 2 19:34:31 snort 99033 S5: Pruned 1 sessions from cache for memcap. 389 scbs remain. memcap: 8387565/8388608 (suppressed 361 times in the last 61 seconds). Jan 2 19:33:31 snort 99033 S5: Pruned 2 sessions from cache for memcap. 743 scbs remain. memcap: 8387767/8388608 (suppressed 10 times in the last 194 seconds).
Any idea what is causing this?
Thanks
Here are some links I found with a quick Google search using the terms "snort stream pruned sessions from cache for memcap". The first link is from the Snort mailing list, and it appears to have your best answer in the third reply in that thread.