topic Re: Firepower: High Snort 2 memory usage in Network Security

Firepower: High Snort 2 memory usage

swscco001 — Mon, 15 May 2023 12:26:19 GMT

Hello everybody,

our customer has a FMCv 7.0.5 and a ASA5516-X with FTD running 7.0.5.

Our moniroring reported a high Snort memory usage:

CRITICAL - mempool Snort System memory_2 usage is 99.56%, mempool DP System memory_2 usage is 44.07% mempool MEMPOOL_MSGLYR_HB_2 usage is 1.64% mempool MEMPOOL_MSGLYR_2 usage is 21.76% mempool MEMPOOL_HEAPCACHE_0_2 usage is 100.00% mempool MEMPOOL_DMA_2 usage is 60.89% mempool MEMPOOL_GLOBAL_SHARED_2 usage is 97.87%

When I login to the FTD I see this issue confirmed:

FTD-LIY-01# show memory all Data Path Free memory: 2626600774 bytes (56%) Used memory: 2067203392 bytes (44%) --------------- --------------- Total memory: 4693804166 bytes (100%) Inspection Engine Free memory: 13709312 bytes ( 0%) Used memory: 3272433664 bytes (100%) <============== --------------- --------------- Total memory: 3286142976 bytes (100%) System Free memory: 1179484160 bytes (14%) Used memory: 7151685632 bytes (86%) --------------- --------------- Total memory: 8331169792 bytes (100%)

The FTD has just a couple of access control rules (see attached).

Attached you also see the IPS policy.

A reboot of the FTD did not solve the issue.

What would you do to reduce the Snort memory usage?

Every hint is welcome!

Bye
R.

Re: Firepower: High Snort 2 memory usage

MHM Cisco World — Mon, 15 May 2023 13:57:26 GMT

https://quickview.cloudapps.cisco.com/quickview/bug/CSCvt34894

Re: Firepower: High Snort 2 memory usage

balaji.bandi — Mon, 15 May 2023 14:38:35 GMT

How long was the uptime, if you reload and monitor what is the results ?

in general RAM usage show that high, but is this impacting any performance issue ?

Re: Firepower: High Snort 2 memory usage

swscco001 — Tue, 16 May 2023 12:36:43 GMT

Hi,

thanks for the hint!

The command 'pmtool restartbytype snort' is reducing the Snort memory
from 100% to 90%. The customer does not reported a performance issue.
The mentioned bug is not for 7.0.5.

I will obseve the Snort memory the next time.

Thanks a lot!

Bye
R.

Re: Firepower: High Snort 2 memory usage

MHM Cisco World — Tue, 16 May 2023 14:42:39 GMT

you are welcome