Snort mailing list archives
Re: [Spam] Reload Snort to use new ruleset
From: "Lay, James" <james.lay () wincofoods com>
Date: Tue, 26 Jul 2011 14:40:35 -0600
What does your syslog say? Mine says the below when sighupping it: Jul 26 14:07:37 goids snort[9188]: --== Reloading Snort ==-- Jul 26 14:08:38 goids snort[9188]: Reload thread starting... Also, try running snort in the foreground (no--D) fire off the sudo kill -SIGHUP <pid> in a different terminal, and see what happens. Lastly get to the snort source and head config.log to verify that it was indeed configured with --reload James From: RICHARD METZER [mailto:rlmst26 () mail rmu edu] Sent: Tuesday, July 26, 2011 2:24 PM To: snort-users () lists sourceforge net Subject: [Spam] [Snort-users] Reload Snort to use new ruleset Importance: Low I understand the command kill -SIGHUP <pid> should reload Snort with the ability to read an updated ruleset. However, it only seems to kill it. I am manually adding new rules, so I would like to reload Snort to avoid any downtime monitoring. I used the -enable-reload switch when I compiled Snort on an Ubuntu OS. What am I missing? Thanks in advance, Rick As I understand the command kill -SIGHUP <pid> should reload Snort with the ability to read an updated ruleset; however, it only seems to kill it. I am manually adding new rules, so I would like to reload Snort to avoid any downtime monitoring. I used the --enable-reload switch when I compiled Snort. What am I missing? Thanks in advance! Rick
------------------------------------------------------------------------------ Got Input? Slashdot Needs You. Take our quick survey online. Come on, we don't ask for help often. Plus, you'll get a chance to win $100 to spend on ThinkGeek. http://p.sf.net/sfu/slashdot-survey
_______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users Please see http://www.snort.org/docs for documentation
Current thread:
- Reload Snort to use new ruleset RICHARD METZER (Jul 26)
- Re: Reload Snort to use new ruleset Gibson, Nathan J. (HSC) (Jul 26)
- Re: Reload Snort to use new ruleset Eoin Miller (Jul 26)
- Re: [Spam] Reload Snort to use new ruleset Lay, James (Jul 26)
- Re: Reload Snort to use new ruleset Castle, Shane (Jul 26)
- Re: Reload Snort to use new ruleset Marcos Rodriguez (Jul 26)
- Re: Reload Snort to use new ruleset Lay, James (Jul 26)
- Re: Reload Snort to use new ruleset Joel Esler (Jul 26)
- Re: Reload Snort to use new ruleset Lay, James (Jul 26)
- Re: Reload Snort to use new ruleset Paul Schmehl (Jul 28)
- Re: Reload Snort to use new ruleset Gibson, Nathan J. (HSC) (Jul 26)
- Re: Reload Snort to use new ruleset Agustin Roca (Jul 27)
- <Possible follow-ups>
- Re: Reload Snort to use new ruleset Gregory Zill (Jul 26)