9.352-6 Memory leak

RE: 9.352-6 Memory leak

IanMorehouse — Wed, 13 Jan 2016 13:57:36 GMT

An update was installed (IPS or anti-virus) yesterday that caused memory useage to drop by 17%. The utm has not been restarted for 17 days.

RE: 9.352-6 Memory leak

IanMorehouse — Thu, 31 Dec 2015 20:27:25 GMT

IPS has been tuned, might need a minor review with some of the newer rules. At the time I took that stats view there was very little traffic going through the UTM. I also notice the the base cpu is rising. We are talking from 2.5% to 5%.
CSSD is running 4.3%

IPS tuning - currently running 1146 rules out of 25082.

RE: 9.352-6 Memory leak

Scott_Klassen — Thu, 31 Dec 2015 20:13:07 GMT

Those percentages don't seem too bad, but it also depends how much traffic is passing through as well. You've now established a baseline and can monitor over time how much they rise. Using the shell tools I mentioned, you can also see specific amounts of RAM used. Another good tool for spotting leaks are the memory usage charts at Logging & Reporting > Hardware. If there's a leak, you may see a steady uphill climb.

Have you ever tuned IPS? This involves disabling rule sets that are not applicable to your environment and turning off older rules.

RE: 9.352-6 Memory leak

IanMorehouse — Thu, 31 Dec 2015 19:49:02 GMT

Hi Scott,
the answer is snort 18% and httpproxy 15%.

RE: [BUG][9.352-6]Memory leak

Scott_Klassen — Thu, 31 Dec 2015 17:23:12 GMT

First thing to do is to determine what exactly is using the memory. From WebAdmin, Support > Advanced > Process List. From shell, use top.or atop (personal preference). Obviously, you'll need to monitor or check several times over a period of time to see where the growth is coming from.