Re: Multiple Snort Instances

[Matt Kettler <mkettler () evi-inc com>]

At 11:05 AM 1/20/2005, Bob Konigsberg wrote:
> Hi all - I've got a bunch of Snort installs where there's a script that runs
> at midnight to do the following:
> 1) Rename the alert file to alert.date (whatever it might be)
> 2) Restart Snort
>
> This results in multiple instances of snort running, and I build up another
> instance per day.
>
> When I run the snort restart (or "snort stop" followed by "snort start")
> manually, I never see this behavior.  It only occurs when the script that
> does it gets run by crontab.
>
> If I manually do an "/etc/init.d/snort stop" both processes are shut down.
> When followed by "/etc/init.d/snort start" then there is, as should be, only
> one instance running.
>
> Any ideas?

Nope..

Perhaps you could fill us in on what 2) does, other than just a genera 
"Restart Snort"..

does it call the init script with restart? Does it call the init script 
with stop, followed by start? does it do it's own kill? Does it send it a 
SIGHUP?




-------------------------------------------------------
This SF.Net email is sponsored by: IntelliVIEW -- Interactive Reporting
Tool for open source databases. Create drag-&-drop reports. Save time
by over 75%! Publish reports on the web. Export to DOC, XLS, RTF, etc.
Download a FREE copy at http://www.intelliview.com/go/osdn_nl
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users