29. Rescontrol
The Rescontrol
(Resource Control) module generates "Warning" level
messages in cases a resource limit has been reached. In most of the cases,
this is caused by very low free main memory levels or false positives that
generated many SYSLOG messages. Resource control is active by default and
can be deactivated with (--norescontrol
).
Resource control:
Stops the THOR scan if the available free main memory drops below 50MB
Switches to
reduced syslog mode
(Warnings and Alerts only) if more than 5MB of data has been sent via Syslog
29.1. Samples
Aug 2 14:37:48 server44/192.168.2.4
THOR: Warning: MODULE: Rescontrol
MESSAGE: Stopping THOR scan in order to avoid a memory outage (use --norescontrol to avoid this)
SCORE: 75
Aug 2 14:37:48 server44/192.168.2.4
THOR: Warning: MODULE: Rescontrol
MESSAGE: Logged more than 5000000 bytes via SYSLOG. This seems odd. Resource control activates 'reduced syslog' mode.
SCORE: 75