[Snort] Can't view Alerts and Blocked page(s), get a blank page; PHP Fatal error

taryezveb

pfSense: 2.0.1-RELEASE (amd64) Snort: 2.9.1 pkg v. 2.1.1

All was working fine before I did the following. Made a couple of changes in Services -> DHCP server [changed some static info] and afterwards Snort restarted itself. A few minutes later I went to check on the Alerts and Blocked tabs in Services -> Snort. But can not view the page with the relevant info, just get a blank page.

I tried a reboot, but still the same. So looked through some of the logs and found this in /tmp/PHP_errors.log:

[07-Feb-2012 12:22:32] PHP Fatal error:  Allowed memory size of 268435456 bytes exhausted (tried to allocate 71 bytes) in /usr/local/www/snort/snort_alerts.php on line 380
[07-Feb-2012 12:22:40] PHP Fatal error:  Allowed memory size of 268435456 bytes exhausted (tried to allocate 71 bytes) in /usr/local/www/snort/snort_blocked.php on line 298
[07-Feb-2012 13:06:33] PHP Fatal error:  Allowed memory size of 268435456 bytes exhausted (tried to allocate 352 bytes) in /usr/local/www/snort/snort_blocked.php on line 298
[07-Feb-2012 13:15:58] PHP Fatal error:  Allowed memory size of 268435456 bytes exhausted (tried to allocate 557 bytes) in /usr/local/www/snort/snort_alerts.php on line 380

Get the above whenever trying to view the Snort Alerts and Blocked info.

How can this be fixed?

Thanks

marcelloc

If you are using 64 bit version and have more then 512Mb of ram, you can try to include this code to increase php memory limit.

It is just an work around for your huge php load and of course do it only if you know how to handle php files

Include

ini_set('memory_limit', '490M');

on

/usr/local/www/snort/snort_alerts.php
/usr/local/www/snort/snort_blocked.php

Do not increase it to a value greater then 510M, suhosin.memory_limit is set to 512M

att,
Marcello Coutinho

taryezveb

@marcelloc:

If you are using 64 bit version and have more then 512Mb of ram, you can try to include this code to increase php memory limit.

It is just an work around for your huge php load and of course do it only if you know how to handle php files

Include
ini_set('memory_limit', '490M');
on

/usr/local/www/snort/snort_alerts.php
/usr/local/www/snort/snort_blocked.php

Do not increase it to a value greater then 510M, suhosin.memory_limit is set to 512M

att,
Marcello Coutinho

Marcello tried what you suggested, but still get:

[07-Feb-2012 14:20:39] PHP Fatal error:  Allowed memory size of 268435456 bytes exhausted (tried to allocate 590 bytes) in /usr/local/www/snort/snort_alerts.php on line 382
[07-Feb-2012 14:20:43] PHP Fatal error:  Allowed memory size of 268435456 bytes exhausted (tried to allocate 354 bytes) in /usr/local/www/snort/snort_blocked.php on line 300

marcelloc

07-Feb-2012 14:20:39] PHP Fatal error:  Allowed memory size of 268435456 bytes exhausted (tried to allocate 590 bytes) in /usr/local/www/snort/snort_alerts.php on line 382

you should get a 512mb error on php not the same 256Mb

taryezveb

After doing a fresh install of Snort, can now view Alerts and Blocked page(s). Was trying to avoid doing a fresh install ;)

jclausen

I also got blank pages on alerts and blocked tab.
I have tried to add: ini_set('memory_limit', '490M'); to snort_blocked.php and snort_alerts.php
then i get this error:
Fatal error: Allowed memory size of 134217728 bytes exhausted (tried to allocate 319 bytes) in /usr/local/www/snort/snort_blocked.php on line 298

running:
2.0.1-RELEASE (i386)
built on Mon Dec 12 18:24:17 EST 2011
FreeBSD 8.1-RELEASE-p6

taryezveb

@jclausen:

I also got blank pages on alerts and blocked tab.
I have tried to add: ini_set('memory_limit', '490M'); to snort_blocked.php and snort_alerts.php
then i get this error:
Fatal error: Allowed memory size of 134217728 bytes exhausted (tried to allocate 319 bytes) in /usr/local/www/snort/snort_blocked.php on line 298

running:
2.0.1-RELEASE (i386)
built on Mon Dec 12 18:24:17 EST 2011
FreeBSD 8.1-RELEASE-p6

You need to be using x64 install, to give this a try:

@marcelloc:

If you are using 64 bit version and have more then 512Mb of ram, you can try to include this code to increase php memory limit.

You can try what worked for me. ie. do a fresh install of Snort