Suricata memory Allocation

Hi All,

I’m interested in testing Suricata in resource-constrained duty.

What’s the best way for me to limit the amount of RAM available to Suricata?

Thanks,

You can limit the memory available to Suricata with ulimit -v. The -v option sets the virtual memory limit:
virtual memory (kbytes, -v) unlimited

OK thanks,

Does this have to be configured before Suricata starts or will this be applied to the currently running instance?

Apologies, I’m fairly new to Suricata.

Thanks,

I think so, ya. No expert on ulimit either, so I think you need to experiment a bit.

Btw, if you want to simulate out of memory conditions during packet processing, make sure to set the limit high enough that the initial startup can succeed.

Great, thanks for your help

You can also use LInux “control groups” to limit the amount of memory used. See https://en.wikipedia.org/wiki/Cgroups for an overview.