Suricata crash - PHP logging memory size
-
Should I care about this kind of stuff?
I turned Suricata on & off last night. I also looked at one log that didn't exist (blocks). I went to bed and woke up to this.
Crash report begins. Anonymous machine information: amd64 12.3-STABLE FreeBSD 12.3-STABLE RELENG_2_6_0-n226742-1285d6d205f pfSense Crash report details: PHP Errors: [16-Jul-2022 08:21:47 CST6CDT] PHP Fatal error: Allowed memory size of 536870912 bytes exhausted (tried to allocate 18419998560 bytes) in /usr/local/www/suricata/suricata_logs_browser.php on line 54 No FreeBSD crash data found. -
@lightingman117 said in Suricata crash - PHP logging memory size:
Should I care about this kind of stuff?
I turned Suricata on & off last night. I also looked at one log that didn't exist (blocks). I went to bed and woke up to this.
Crash report begins. Anonymous machine information: amd64 12.3-STABLE FreeBSD 12.3-STABLE RELENG_2_6_0-n226742-1285d6d205f pfSense Crash report details: PHP Errors: [16-Jul-2022 08:21:47 CST6CDT] PHP Fatal error: Allowed memory size of 536870912 bytes exhausted (tried to allocate 18419998560 bytes) in /usr/local/www/suricata/suricata_logs_browser.php on line 54 No FreeBSD crash data found.That error happens when you try to view a log file that is too large to fit into available memory. Configure log rotation on the LOGS MGMT tab to keep your log sizes under control.
This is a common error with several sub-systems on pfSense that must read text logs and display them. The log files need to be small enough to fit into the physical memory space allocated to PHP because they are processed into an in-memory string and then output via the web server of pfSense. If not, then the error you saw is thrown. It is harmless in that it will not crash your box, but obviously the large text file can't be read using the GUI tools.
