Re: Snort dying

[Zakai Kinan <titanyen2000 () yahoo com>]

My company is using debian and we have standardized on it.  I will keep looking.

--- On Mon, 2/8/10, Jason Wallace <jason.r.wallace () gmail com> wrote:

> From: Jason Wallace <jason.r.wallace () gmail com>
> Subject: Re: [Snort-users] Snort dying
> To: "Snort Users" <snort-users () lists sourceforge net>
> Date: Monday, February 8, 2010, 7:12 AM
> I've seen this happen in 2 different
> cases...
>
> 1) If you have a system with less than 2GB RAM try setting
> "config
> detection: search-method lowmem" in your snort.conf. If
> that solves
> the problem you can play around with the different
> detection options
> to see which one works for you.
>
> 2) Precompiled So rules: If you are using precompiled SO
> rules try
> picking a different distro or turning them off completely
> just to see
> if that is the problem. I have seen a couple of times where
> snort
> would start fine, but then bomb out a couple of hours
> later. I started
> using SO rules for a different distro and the problem went
> away.
>
> Wally
>
> On Sun, Feb 7, 2010 at 5:05 PM, Zakai Kinan <titanyen2000 () yahoo com>
> wrote:
> > I have had snort running for a couple of months now.
>  It is stopping from time to time and I can't figure out
> why.  It is probably due to a rule.  The log is of no
> help.  Does anyone have a way to tell which rule is causing
> the problem?
> > TIA,
> >
> >
> > Zak
> ------------------------------------------------------------------------------
> > The Planet: dedicated and managed hosting, cloud
> storage, colocation
> > Stay online with enterprise data centers and the best
> network in the business
> > Choose flexible plans and management services without
> long-term contracts
> > Personal 24x7 support from experience hosting pros
> just a phone call away.
> > http://p.sf.net/sfu/theplanet-com
> > _______________________________________________
> > Snort-users mailing list
> > Snort-users () lists sourceforge net
> > Go to this URL to change user options or unsubscribe:
> > https://lists.sourceforge.net/lists/listinfo/snort-users
> > Snort-users list archive:
> > http://www.geocrawler.com/redir-sf.php3?list=snort-users
>
> ------------------------------------------------------------------------------
> The Planet: dedicated and managed hosting, cloud storage,
> colocation
> Stay online with enterprise data centers and the best
> network in the business
> Choose flexible plans and management services without
> long-term contracts
> Personal 24x7 support from experience hosting pros just a
> phone call away.
> http://p.sf.net/sfu/theplanet-com
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users


      

------------------------------------------------------------------------------
SOLARIS 10 is the OS for Data Centers - provides features such as DTrace,
Predictive Self Healing and Award Winning ZFS. Get Solaris 10 NOW
http://p.sf.net/sfu/solaris-dev2dev
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users