Since v2.0 upgrade, packet engine won't stay running

[Lurick]

Quick question, do you all have "Do not pin engine packet processor to dedicated CPU cores" checked or unchecked?
I had mine checked but I tried unchecking it now and will see if that does anything.
I have Suricata installed but not enabled for IPS mode.

Mine was unchecked. I didn't test with it checked.

Hmmm, ok, I had crashes with it checked so that's likely just a red herring then

[vutt01]

Helpdesk suggested for me as well  dev.netmap.ring_num=1024 fix and now I'm observing different behavior. It still reporting "eastpect   stack overflow detected; terminated" but process keeps running and firewall appears to be working. I restarted manually engine ~6h ago and htop is reporting that process has been running since.

Code Select Expand

61 processes:  1 running, 60 sleeping
CPU:  2.2% user,  0.0% nice,  0.7% system,  0.0% interrupt, 97.1% idle
Mem: 1692M Active, 4284M Inact, 792K Laundry, 8716M Wired, 192K Buf, 993M Free

  PID USERNAME    THR PRI NICE   SIZE    RES STATE    C   TIME    WCPU COMMAND
34985 root         13  20  -20  8457M   274M nanslp   1   6:36  11.39% eastpect
25132 root         11  20  -20  1254M    39M uwait    0   1:51   0.91% ipdrstreamer


[Seimus]

Helpdesk suggested for me as well  dev.netmap.ring_num=1024 fix and now I'm observing different behavior. It still reporting "eastpect   stack overflow detected; terminated" but process keeps running and firewall appears to be working. I restarted manually engine ~6h ago and htop is reporting that process has been running since.

Code Select Expand

61 processes:  1 running, 60 sleeping
CPU:  2.2% user,  0.0% nice,  0.7% system,  0.0% interrupt, 97.1% idle
Mem: 1692M Active, 4284M Inact, 792K Laundry, 8716M Wired, 192K Buf, 993M Free

  PID USERNAME    THR PRI NICE   SIZE    RES STATE    C   TIME    WCPU COMMAND
34985 root         13  20  -20  8457M   274M nanslp   1   6:36  11.39% eastpect
25132 root         11  20  -20  1254M    39M uwait    0   1:51   0.91% ipdrstreamer


It helps to stabilize it a bit. But doesn't fixes it. If the Engine starts to crash in cascade ZA stops it and it needs to be manually started.

Issue is not fixed by increasing the ring_num.

Regards,
S.

[Lurick]

Yup, just had another crash after about 5-6 hours of stability

[sy]

Hi all,

Thank you for your patience. We've identified a fix for the issue and are currently testing it. If you'd like to test it as well, please reach out to support for detailed instructions. The fix is scheduled to be included in the 2.0.1 maintenance release later this week.