p0f Too many host entries, deleting
Is the following output in our /var/log/messages log of any concern?
I came across this thread:
2019 Aug 16 22:41:27 (cpanel-6) ->/var/log/messages Aug 16 17:41:25 cpanel-6 p0f: [!] WARNING: Too many host entries, deleting 1001. Use -m to adjust.
2019 Aug 16 22:41:27 (cpanel-6) ->/var/log/messages Aug 16 17:41:26 cpanel-6 p0f: [!] WARNING: Too many host entries, deleting 1001. Use -m to adjust.
2019 Aug 16 22:41:27 (cpanel-6) ->/var/log/messages Aug 16 17:41:27 cpanel-6 p0f: [!] WARNING: Too many host entries, deleting 1001. Use -m to adjust.
2019 Aug 16 22:41:29 (cpanel-6) ->/var/log/messages Aug 16 17:41:27 cpanel-6 p0f: [!] WARNING: Too many host entries, deleting 1001. Use -m to adjust.
2019 Aug 16 22:41:29 (cpanel-6) ->/var/log/messages Aug 16 17:41:28 cpanel-6 p0f: [!] WARNING: Too many host entries, deleting 1001. Use -m to adjust.
2019 Aug 16 22:41:29 (cpanel-6) ->/var/log/messages Aug 16 17:41:29 cpanel-6 p0f: [!] WARNING: Too many host entries, deleting 1001. Use -m to adjust.
2019 Aug 16 22:41:31 (cpanel-6) ->/var/log/messages Aug 16 17:41:29 cpanel-6 p0f: [!] WARNING: Too many host entries, deleting 1001. Use -m to adjust.
2019 Aug 16 22:41:31 (cpanel-6) ->/var/log/messages Aug 16 17:41:30 cpanel-6 p0f: [!] WARNING: Too many host entries, deleting 1001. Use -m to adjust.
2019 Aug 16 22:41:31 (cpanel-6) ->/var/log/messages Aug 16 17:41:31 cpanel-6 p0f: [!] WARNING: Too many host entries, deleting 1001. Use -m to adjust.
2019 Aug 16 22:41:33 (cpanel-6) ->/var/log/messages Aug 16 17:41:31 cpanel-6 p0f: [!] WARNING: Too many host entries, deleting 1001. Use -m to adjust.I came across this thread:
-
Don't know if bumping is frowned upon, but if so I apologize in advance. 0 -
This message indicates that p0f is reaching its cap of how many hosts/connections it is tracking. Once the limit is reached, the oldest 10% entries gets pruned to make room for new data. This setting helps to control the memory footprint of p0f. I don't believe these messages are necessarily a cause for concern, but they could indicate this server is receiving an increased amount of traffic. There is also typically no need to bump threads, we look at every open thread in the order it's received. If you need immediate assistance, I'd suggest opening a ticket where there is dedicated staff available 24/7 to assist. 0 -
Thanks Lauren, I appreciate the response. Forgive my bumping - open tickets have a way of causing me to do irrational things. Have a good day :) 0
Please sign in to leave a comment.
Comments
3 comments