Hello everybody,
our customer has a FMCv 7.0.5 and a ASA5516-X with FTD running 7.0.5.
Our moniroring reported a high Snort memory usage:
CRITICAL - mempool Snort System memory_2 usage is 99.56%, mempool DP System memory_2 usage is 44.07%
mempool MEMPOOL_MSGLYR_HB_2 usage is 1.64%
mempool MEMPOOL_MSGLYR_2 usage is 21.76%
mempool MEMPOOL_HEAPCACHE_0_2 usage is 100.00%
mempool MEMPOOL_DMA_2 usage is 60.89%
mempool MEMPOOL_GLOBAL_SHARED_2 usage is 97.87%
When I login to the FTD I see this issue confirmed:
FTD-LIY-01# show memory all
Data Path
Free memory: 2626600774 bytes (56%)
Used memory: 2067203392 bytes (44%)
--------------- ---------------
Total memory: 4693804166 bytes (100%)
Inspection Engine
Free memory: 13709312 bytes ( 0%)
Used memory: 3272433664 bytes (100%) <==============
--------------- ---------------
Total memory: 3286142976 bytes (100%)
System
Free memory: 1179484160 bytes (14%)
Used memory: 7151685632 bytes (86%)
--------------- ---------------
Total memory: 8331169792 bytes (100%)
The FTD has just a couple of access control rules (see attached).
Attached you also see the IPS policy.
A reboot of the FTD did not solve the issue.
What would you do to reduce the Snort memory usage?
Every hint is welcome!
Bye
R.
