Snort mailing list archives
Re: kill -HUP doesn't work
From: Demetri Mouratis <dmourati () cm math uiuc edu>
Date: Mon, 22 Sep 2003 18:58:27 -0500 (CDT)
On 22 Sep 2003, Florin Andrei wrote:
It looks like kill -HUP $snort_pid does not work. If i run it, snort dies. Here are the system logs at the moment when a system script attempted to rotate the snort logs:
<snip>
Sep 21 04:02:02 tart snort: FATAL ERROR: OpenPcap() device eth0 open: ^Isocket: Operation not permitted Sep 22 04:02:02 tart snort: snort shutdown failed
Here's your problem. It looks like the user running snort no longer has privilidges on the eth0 interface. This most likely means you used either the -u <uname> command line option when you started snort, or you're running in some kind of chroot'ed environment. To work around this you can create a sysvinit script under /etc/init.d/snort then simply do /etc/init.d/snort restart from your logrotate script. HTH. --------------------------------------------------------------------- Demetri Mouratis dmourati () linfactory com ------------------------------------------------------- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http://thinkgeek.com/sf _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- kill -HUP doesn't work Florin Andrei (Sep 22)
- Re: kill -HUP doesn't work Matt Kettler (Sep 22)
- Re: kill -HUP doesn't work Demetri Mouratis (Sep 22)
- Re: kill -HUP doesn't work Florin Andrei (Sep 22)