Snort mailing list archives
Re: Reload Snort to use new ruleset
From: Marcos Rodriguez <marcos.e.rodriguez () gmail com>
Date: Tue, 26 Jul 2011 16:50:52 -0400
On Tue, Jul 26, 2011 at 4:44 PM, Castle, Shane <scastle () bouldercounty org>wrote:
The command "kill -SIGHUP <pid>" has not worked for some time with Snort IIRC (nor pkill, which I had been using before) and the suggested init.d entry for controlling snort does not use it, either, but rather stop and start: restart|reload) $0 stop $0 start I suspect the doc needs updating. Add in using barnyard2 and things get more interesting. Here is my current cron script that uses oinkmaster (no pulledpork suggestions please): #!/bin/bash cd /etc/snort /sbin/service barnyard2 stop ./oinkmaster.pl -o ./rules -b ./backup -C ./bleeding-oink.conf -C ./oinkmaster.conf >oink.out 2>&1 ./create-sidmap.pl rules >sid-msg.map /sbin/service snort restart /sbin/service barnyard2 start -- Shane Castle Data Security Mgr, Boulder County IT CISSP GSEC GCIH -----Original Message----- From: RICHARD METZER [mailto:rlmst26 () mail rmu edu] Sent: Tuesday, July 26, 2011 14:24 To: snort-users () lists sourceforge net Subject: [Snort-users] Reload Snort to use new ruleset I understand the command kill -SIGHUP <pid> should reload Snort with the ability to read an updated ruleset. However, it only seems to kill it. I am manually adding new rules, so I would like to reload Snort to avoid any downtime monitoring. I used the -enable-reload switch when I compiled Snort on an Ubuntu OS. What am I missing? Thanks in advance, Rick As I understand the command kill -SIGHUP <pid> should reload Snort with the ability to read an updated ruleset; however, it only seems to kill it. I am manually adding new rules, so I would like to reload Snort to avoid any downtime monitoring. I used the --enable-reload switch when I compiled Snort. What am I missing? Thanks in advance! Rick
Hi Gents, You need to make sure Snort is compiled with the --enable-reload switch in your ./configure line. This is to allow continued inspection when you make changes to your active .conf file. Hope this helps! marcos
------------------------------------------------------------------------------ Got Input? Slashdot Needs You. Take our quick survey online. Come on, we don't ask for help often. Plus, you'll get a chance to win $100 to spend on ThinkGeek. http://p.sf.net/sfu/slashdot-survey
_______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users Please see http://www.snort.org/docs for documentation
Current thread:
- Reload Snort to use new ruleset RICHARD METZER (Jul 26)
- Re: Reload Snort to use new ruleset Gibson, Nathan J. (HSC) (Jul 26)
- Re: Reload Snort to use new ruleset Eoin Miller (Jul 26)
- Re: [Spam] Reload Snort to use new ruleset Lay, James (Jul 26)
- Re: Reload Snort to use new ruleset Castle, Shane (Jul 26)
- Re: Reload Snort to use new ruleset Marcos Rodriguez (Jul 26)
- Re: Reload Snort to use new ruleset Lay, James (Jul 26)
- Re: Reload Snort to use new ruleset Joel Esler (Jul 26)
- Re: Reload Snort to use new ruleset Lay, James (Jul 26)
- Re: Reload Snort to use new ruleset Paul Schmehl (Jul 28)
- Re: Reload Snort to use new ruleset Gibson, Nathan J. (HSC) (Jul 26)
- Re: Reload Snort to use new ruleset Agustin Roca (Jul 27)
- <Possible follow-ups>
- Re: Reload Snort to use new ruleset Gregory Zill (Jul 26)