snort high CPU

Hello there,

Thank you for contacting the Sophos Community!

Do you see any coredump under /var/cores?

You could check syslog.log and csc.log around the time of the issue to see if they have any info.

Regards,

Hello,

no, there are no coredumps.

In syslog.log  I don't see anything so it would be different from running at other times

In csc.log  I don't see anything so it would be different from running at other times

Regards,

Hello,

no, there are no coredumps.

In syslog.log  I don't see anything so it would be different from running at other times

In csc.log  I don't see anything so it would be different from running at other times

Regards,

I notice also times with high snort load. Seems higher than usual in our environment.

No dumps.

Still the "old" Snort rules:

What has become with IPS after Jan 15th? Sophos announced a change so I had expected some "brandnew" IPS patterns or so, but it seems, nothing has happened.

Also note this recent thread  - I reported no unusual activity there some days ago but maybe there are...?

community.sophos.com/.../ips-service-makes-cpu-up-to-100-this-morning

The change was to do with end of life support for older versions of XG.

ian

[Jan 19 11:39:49 :10649]:failed to get sessiontbl data for session id 5631 rev 15943 pkt_len 0 datalink_type 228 direction 0 daq_source 2 is_tcp 0 nseid 0 is_ssl_non_app_appdata 0, dropping packet
[Jan 19 11:39:49 :10649]:Error reading session data,status -1
[Jan 19 11:39:49 :10649]:failed to get sessiontbl data for session id 5631 rev 15943 pkt_len 0 datalink_type 228 direction 0 daq_source 2 is_tcp 0 nseid 0 is_ssl_non_app_appdata 0, dropping packet
[Jan 19 11:40:46:393894 :10652]:DAQ:INFO:daq_ssl.c:1008(ssl_daq_send_pkt_and_verd)--> [S:5552.38070]Ignore flow failed, nse_ret 0xB4000F0F
[Jan 19 11:40:53:514852 :10652]:DAQ:INFO:daq_ssl.c:1008(ssl_daq_send_pkt_and_verd)--> [S:2876.16105]Ignore flow failed, nse_ret 0xB4000F0F

UST sessiontbl_get_tuple API returned -1[Jan 19 12:20:36:653718 :10650]:DAQ:INFO:daq_nmsp.c:3155(common_inject)--> [S:4342.52039]Unable to get the tuple info from the kernel conntrack for injection. dir 1, pkt length 1340

recent IPS sample logs. similar logs like from Ladislav Benes Cannot say if it is common logs or indicating issues. Have not monitored ips log frequently in the past.

Hello Ladislav,

Thank you for the follow-up!

I checked my XG and see the same entries, however, didn't find a reason for this, so I will try to get some info on this, however, I am not sure if these messages are the cause of the high CPU usage, I would recommend you to follow this KB to follow resource utilization and open a case with Support (Send me the Case ID) if the issue happens again.

Regards,

after the latest IPS pattern update the load by snort has decreased significantly.

compare this screenshot with mine from yesterday:

Hello LHerzog,

Thank you for the update!  ( I edited my post)

It seems the issue was resolved for another user after the Pattern update also.

community.sophos.com/.../458320

Regards,