Snort PID problem

["Sheahan, Paul (PCLN-NW)" <Paul.Sheahan () priceline com>]

I've been using Snort 1.7 on a Red Hat Linux 7.0 box with no problems for a
month now. I have a script that shuts down Snort and runs some reports, then
restarts Snort again and it usually works fine

For some reason Snort wasn't shutting down properly in the script. I use
kill `cat /var/run/snort_eth0.pid` to shutdown snort in the script, but
snort_eth0.pid always contains an non-existent process ID so it never shuts
down. In any case, I decided to reboot to get a fresh start. Now when I run
my snort startup script I get the following:

----------------------------------------------------------------------------
----------------------------------------------------------------------------
        --== Initializing Snort ==--
Rule application order changed to Pass->Alert->Log

Initializing Network Interface eth0
Kernel filter, protocol ALL, raw packet socket
Decoding Ethernet on interface eth0
Initializing Preprocessors!
Initializing Plug-ins!
Initializating Output Plugins!

+++++++++++++++++++++++++++++++++++++++++++++++++++
Initializing rule chains...
WARNING: command line overrides rules file alert plugin!
/etc/snort/startup: line 4:   854 Segmentation fault      (core dumped)
/usr/sbin/snort
-A full -c /etc/snort/snort.conf -i eth0 -l /var/log/snort -o -N -b -L
traces

----------------------------------------------------------------------------
------------------------------------------------------------------

Does anyone know what this means? Also, has anyone run into the
snort_eth0.pid issue where the PID in the file is wrong?

Thanks


_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
http://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users