Loss of Internet and High Memory Usage in 8.3.1

Hi, I lost all  Internet traffic and having High Memory Usage 90% I'm running v1.51 SP1 + Hotfix May 28  Version 8.3.1   I have tried to rest but the Memory Usage shoots back up to 90% I have attached the system logs any help would be appreciated


system_logs.txt

Your Dnsmasq and snort isn't loaded causing the high memory available. According to your logs you have an error with a rule so just clear out your rules so you can restart. As for dnsmasq check line 13 of /var/etc/dnsmasq.conf

Bread
You have a rule which has something wrong in its layout

Wed Jun 22 09:16:51 2016 daemon.err snort[4886]: FATAL ERROR: /etc/snort/rules/snort.rules(3601) Unknown rule type: sid:drop.

Just find this rule and either delete or put # at the beginning to comment out the rule, then restart the shield.

Roadrunnere42

Thanks @ Roadrunnere42 and @user8446 it happened right after the daily IPS updates can you confirm where I can change the rules at please is it via LuCI or CLI?

Thanks

Just search for "sid:drop" and comment out as mentioned or delete your whole ruleset out and update it again. Your rules are at /etc/snort/rules/snort.rules

user8446 wrote

or delete your whole ruleset out and update it again. Your rules are at /etc/snort/rules/snort.rules

This is the easiest solution... rename /etc/snort/rules/snort.rules to something like /etc/snort/rules/snort.rules.sav and then manually run the fw_upgrade script. It will regenerate the snort.rules file.

Hi, Wisiwyg that great Idea just to confirm I would run the  fw_upgrade. 8.3 via SSH?

Thanks

Thanks @Wisiwyg @user8446 @Roadrunnere42 it worked I'm back up I did see few errors  but have full internet and Memory back to 49% I renamed the /snort/rules


Sat Jun 25 11:31:23 2016 daemon.emerg procd: 42544 66620.334   69208.0     61.6  63069082.5  46829.2         0
Sat Jun 25 11:31:23 2016 user.notice root: Successful NTP clock adjust (0.us.pool.ntp.org).
Sat Jun 25 11:31:23 2016 daemon.info procd: - init complete -
Sat Jun 25 11:31:47 2016 kern.info kernel: [  168.349165] nf_conntrack: automatic helper assignment is deprecated and it will be removed soon. Use the iptables CT target to attach helpers instead.

Glad it worked!

Thanks for the shortcut  it saved me a lot of time