OPNsense Forum

English Forums => Intrusion Detection and Prevention => Topic started by: Georges on September 29, 2020, 12:37:29 pm

Title: Just ran out of space in queue - Suricata Crash
Post by: Georges on September 29, 2020, 12:37:29 pm

Hello, i got this error, any idea?

Title: Re: Just ran out of space in queue - Suricata Crash
Post by: Helle on September 29, 2020, 02:26:22 pm

This is probably related to the problem I and several others have, possibly pointing to some rulesets growing massively and causing errors. I have to disable abuse.ch/URLhaus to start suricata.

I did get the same error as you during my trial and errors..

Title: Re: Just ran out of space in queue - Suricata Crash
Post by: Georges on September 29, 2020, 06:45:38 pm

ok thanks!

Title: Re: Just ran out of space in queue - Suricata Crash
Post by: Helle on September 30, 2020, 10:32:10 am

A few hours later, my box is able to load the list again but it takes 25 minutes to reload the rules so I expect suricata to come crashing down any day soon due to the size of the rule set. It could also be a temporary corrupt rule set at URLhaus that now is fixed.

Title: Re: Just ran out of space in queue - Suricata Crash
Post by: echo_123 on September 30, 2020, 06:08:16 pm

Hi everyone,

the same issue here:
2020-09-28T21:43:16   suricata[80031]   [100112] <Critical> -- [ERRCODE: SC_ERR_AHO_CORASICK(174)] - Just ran out of space in the queue.  Fatal Error.  Exiting.  Please file a bug report on this
2020-09-28T21:35:15   suricata[42527]   [100265] <Notice> -- This is Suricata version 5.0.3 RELEASE running in SYSTEM mode
2020-09-28T19:45:03   suricata[39423]   [100184] <Critical> -- [ERRCODE: SC_ERR_AHO_CORASICK(174)] - Just ran out of space in the queue.  Fatal Error.  Exiting.  Please file a bug report on this

Any hints that could lead to the solution or workaround? Thank you!

Title: Re: Just ran out of space in queue - Suricata Crash
Post by: meschmesch on October 05, 2020, 09:25:37 am

Same problem here.

Code: [Select]

2020-10-02T23:34:46 suricata[11312] [101016] <Critical> -- [ERRCODE: SC_ERR_AHO_CORASICK(174)] - Just ran out of space in the queue. Fatal Error. Exiting. Please file a bug report on this
2020-10-02T23:29:48 suricata[94676] [100093] <Notice> -- This is Suricata version 5.0.3 RELEASE running in SYSTEM mode
2020-10-01T21:04:05 suricata[23078] [100122] <Critical> -- [ERRCODE: SC_ERR_AHO_CORASICK(174)] - Just ran out of space in the queue. Fatal Error. Exiting. Please file a bug report on this
Disabling of abuse.ch/URLhaus did help, but this is not a solution. By the way, I have plenty of memory available, in total 8GB RAM, and with URLhaus enabled still 35% Ram left free.

Title: Re: Just ran out of space in queue - Suricata Crash
Post by: meschmesch on October 11, 2020, 07:03:45 pm

Hello,
isn't there any solution? None any idea?

Title: Re: Just ran out of space in queue - Suricata Crash
Post by: Georges on October 13, 2020, 12:16:24 pm

No :/.
For now when i start the suricata on one of my interface, the interface crash and can't communicate anymore...
I have to restart the VM to make it work and stop suricata.

Title: Re: Just ran out of space in queue - Suricata Crash
Post by: Brano on October 22, 2020, 05:19:42 pm

Same issue here

Code: [Select]

2020-10-21T08:53:20 suricata[52318] [101262] <Critical> -- [ERRCODE: SC_ERR_AHO_CORASICK(174)] - Just ran out of space in the queue. Fatal Error. Exiting. Please file a bug report on this
2020-10-21T08:47:24 suricata[52303] [100253] <Notice> -- This is Suricata version 5.0.3 RELEASE running in SYSTEM mode

Title: Re: Just ran out of space in queue - Suricata Crash
Post by: Brano on October 22, 2020, 05:36:17 pm

How can I delete Surricata rules? I was playing with various sources and now have 217048 rules on the system, all set to Alert. Just want to delete them all and download only what I need.
Disabling alerting is really PITA as one can do only 1000 rules at a time. I prefer to delete them all and start from scratch.