Followup question about Ring PCAP\Snort\Environment Variables

["Mark Ewert" <mewert () ihcis com>]

Thank you to all who responded with the method to simply add them to the
command line which launches Snort such as:

 

exec env PCAP_FRAMES=max snort ${snort_options}

 

or

 

PCAP_TO_MS=0 PCAP_FRAMES=max snort

 

Here's another twist to my situation. We're using SnortCenter to control
the config files and stop\start Snort. Anyone have any idea how to add
these environment variables to a SnortCenter based config? I've been
checking out web-lib.pl in SnortCenter's CGI directory which is read by
index.cgi which appears to control the sensors but I suspect that these
variables would be applied to the account Apache is running under and
not the Snort account.

 

Anyone have any ideas? Do we need to abandon SnortCenter?

 

THANKS!

 

M

 

---------------------------------------------

Mark F. Ewert, Principal Systems Architect

Integrated Healthcare Information Services

www.ihcis.com <http://www.ihcis.com/> 

 


---------------------------------------------------------------------------
This e-mail and the information transmitted within it is intended only
for the recipient(s) to which it is addressed and may contain confidential
and/or privileged material. Any review, retransmission, dissemination or 
other use of; or taking of any action in reliance upon this information
by persons or entities other than the intended recipient is prohibited. 
If you received this in error, please send the e-mail back to notify the
sender and delete the message and its contents from any computers and
network systems involved in its receipt. Thank you.