Snort out of memory???

  • I have just installed snort on a 1.2gig P3 machine with 2gig of Memory.  I cant get Snort to run in any other performance mode but "lowmem".  What gives? Do you really need 2gig+ of memory to run Snort?

  • No 1gig is enough to run in ac-sparsebands. I have 1gig and it is running smooth in that perfomance setting. Keep in mind that the more rulesets you have enabled, the greater the memory consumption will be.

  • I think there have been reports in the past that some of the rules can cause issues if enabled (either meaning they eat lot of mem or whatever). Maybe try to uncheck some rules and add them back one by one. I have snort running on a 1U server with 1.2GB with no issues.

Log in to reply