Snort ( Pruned 1 sessions from cache for memcap )



  • Hi, i am seeing these error messages in my snort logs I thought it was the Max Queued Seg or bytes so I have been playing with those values and nothing is working.  Has anyone else come across this error message?

    Feb 20 21:03:21 snort[8645]: S5: Pruned 1 sessions from cache for memcap. 1 ssns remain. memcap: 13890512/8388608
    Feb 20 21:03:21 snort[8645]: S5: Pruned 1 sessions from cache for memcap. 1 ssns remain. memcap: 13890512/8388608
    Feb 20 21:03:17 snort[8645]: S5: Pruned 31 sessions from cache for memcap. 1 ssns remain. memcap: 8424958/8388608
    Feb 20 21:03:17 snort[8645]: S5: Pruned 31 sessions from cache for memcap. 1 ssns remain. memcap: 8424958/8388608


Log in to reply