Snort Crash Error Cyrus

["R Warner" <R.J.Warner () warwick ac uk>]

I am fairly new to Snort and have just got it up and running on Fedora Core 2.

Running in IDS  mode, everything is fine and it runs all day and most of the night until 04:02 every morning, when it 
crashes! I've upgraded the version of Snort to a more up to date release but am still having this problem, so can 
conclude it is something within my OS that is interfering with it. I have no other services running except SSH and HTTP 
and no crontabs either. It is more or less a fresh install.

This is the error i receive within the /var/messages log.

----------------------------------------------------------------------------------------------------------------
Oct 26 18:00:56 nt131 sshd(pam_unix)[1077]: session opened for user jim by (uid=500)
Oct 26 18:01:21 nt131 su(pam_unix)[1122]: session opened for user root by jim(uid=500)
Oct 26 22:18:36 nt131 sshd(pam_unix)[1681]: session opened for user root by (uid=0)
Oct 26 22:19:06 nt131 sshd(pam_unix)[1681]: session closed for user root
Oct 27 04:02:15 nt131 su(pam_unix)[2683]: session opened for user cyrus by (uid=0)
Oct 27 04:02:16 nt131 su(pam_unix)[2683]: session closed for user cyrus
Oct 27 04:02:19 nt131 kernel: device eth0 left promiscuous mode
Oct 27 04:02:19 nt131 snortd: snort shutdown succeeded
Oct 27 04:02:20 nt131 kernel: device eth0 entered promiscuous mode
Oct 27 04:02:20 nt131 snort: Initializing daemon mode
Oct 27 04:02:20 nt131 snort: PID path stat checked out ok, PID path set to /var/run/
Oct 27 04:02:20 nt131 snort: Writing PID "2731" to file "/var/run//snort_eth0.pid"
--------------------------------------------------------------------------------------------------------------

It would seem like cyrus is interefering with it in some way. Any suggestions please?

Thanks



-------------------------------------------------------
This Newsletter Sponsored by: Macrovision
For reliable Linux application installations, use the industry's leading
setup authoring tool, InstallShield X. Learn more and evaluate
today. http://clk.atdmt.com/MSI/go/ins0030000001msi/direct/01/
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users