PHP ERROR: Type 1 - reoccurring alert

[shinobi]

I have seen this alert & cleared it a few times. It seemed to pop up right around the Log4j debut.. so any log related error is causing me to 2nd glance it.
Does this look like a legit "not enough memory" message, or maybe a buffer overrun.. ?

PHP errors
PHP ERROR: Type: 1, File: /usr/local/www/suricata/suricata_logs_browser.php, Line: 54, Message: Allowed memory size of 536870912 bytes exhausted (tried to allocate 6336420904 bytes) @ 2022-03-12 01:20:08

[SteveITS]

@shinobi Ensure you have the log rotation and deletion settings enabled for Suricata.

Also if your router has a slower CPU disable log compression in pfSense in the system log settings.

[bmeeks]

@shinobi said in PHP ERROR: Type 1 - reoccurring alert:

I have seen this alert & cleared it a few times. It seemed to pop up right around the Log4j debut.. so any log related error is causing me to 2nd glance it.
Does this look like a legit "not enough memory" message, or maybe a buffer overrun.. ?

PHP errors
PHP ERROR: Type: 1, File: /usr/local/www/suricata/suricata_logs_browser.php, Line: 54, Message: Allowed memory size of 536870912 bytes exhausted (tried to allocate 6336420904 bytes) @ 2022-03-12 01:20:08

Your log file has grown too large to view using the PHP viewer applet. That code works by loading the entire log into RAM and then displaying it to the browser as one string. The PHP process in pfSense has a limited amount of RAM allocated for it, so if the log file is too big, that limited RAM is exhausted when trying to load the log.

The solution, as @SteveITS said, is to turn on the log rotation options and set a much smaller log size for alerts.