Suricata 6.0.3_3 Package Update -- Release Notes
-
Suricata v6.0.3_3 Release Notes
This update contains two bug fixes and one minor new feature. This release is now available for both the DEVEL and RELEASE branches of pfSense.
New Features:
- Add option to the INTERFACE SETTINGS tab for enabing more verbose logging in the
suricata.log
file from Suricata when starting up and shutting down an interface instance.
Bug Fixes:
-
When using Inline IPS Mode with VLANs, because the netmap device cannot process VLAN tags, Suricata should pass the VLAN's parent interface as the physical interface where netmap will operate. This corrects an issue where Inline IPS Mode interfaces on VLANs failed to start with the new multiple host rings netmap code.
-
The default value for TCP Stream Memcap (on the FLOW/STREAM tab) for greenfield installs is increased from 64 MB to 128 MB. This higher value is more likely to be needed with modern higher core-count processors. If you run into a situation where Suricata fails to start and logs an error about failing to allocate memory, go to the FLOW/STREAM tab and scroll down to the Stream Memory Cap and Reassembly Memory Cap parameters and try increasing their values to 131217728.
Note this change only impacts a new greenfield install! Existing installations will not be modified! The user should make their own modifications to any existing Suricata installation if desired.
- Add option to the INTERFACE SETTINGS tab for enabing more verbose logging in the
-
PHP Fatal error: Allowed memory size of 536870912 bytes exhausted (tried to allocate 227565568 bytes) in /usr/local/www/suricata/suricata_logs_browser.php on line 59
This error is related to the memory cap? i have changed the values with this new one just now :)
I have also activated the verbose logging...maybe it's the problem. I don't know -
@xm4rcell0x the "PHP" error means PHP can't read a file that big into memory. Are your log files not rotating?
-
@steveits i think yes, because when tried to reload suricata it won't refresh the suricata.log
I think I have solved after 2 or 3 reloads -
Yes, that is a common PHP error when attempting to load and read very large log files. PHP must load the entire file contents into memory, then stream that memory data out to your browser. There is a limited amount of system memory allocated to the PHP process, thus when it tries to open a very large file it will exhaust the memory reserved for PHP processes.
You can view the file from the CLI using something like the
vi
editor, or you can use various forms of sftp to connect and grab the file. One of my favorite tools for this kind of stuff is WinSCP.