Snort mailing list archives
Re: Reload Snort to use new ruleset
From: "Lay, James" <james.lay () wincofoods com>
Date: Tue, 26 Jul 2011 16:19:01 -0600
I didn't know that on the sid-msg.map file..thanks for the heads up Joel. If I run into any issues with the restart I'll let you know, but so far it's ran like a champ. James
-----Original Message----- From: Joel Esler [mailto:jesler () sourcefire com] Sent: Tuesday, July 26, 2011 3:59 PM To: Lay, James Cc: snort-users () lists sourceforge net Subject: Re: [Snort-users] Reload Snort to use new ruleset If there are errors with restart, we'd like a bug report. However, I
don't
know of any off the top of my head, and as far as I know it works with regard to the documentation. You will need to restart barnyard if you need it to re-read the
sid-msg.map
file. J On Jul 26, 2011, at 5:44 PM, Lay, James wrote:Odd...I've had no issues with sending SIGHUP to snort 2.9.0.5.
Also,
I don't think you need to kill barnyard2 every time you restart snort....barnyard2 is smart enough to start reading the new unified file once it's created (I think that's what the -d directive is
for):
Jul 26 15:25:29 ids barnyard2[15104]: Closing spool file '/opt/var/log/lan/lan.u2.1311714681'. Read 4 records Jul 26 15:25:29 ids barnyard2[15104]: Opened spool file '/opt/var/log/lan/lan.u2.1311715529' Jul 26 15:25:29 ids barnyard2[15104]: Waiting for new data James-----Original Message----- From: Castle, Shane [mailto:scastle () bouldercounty org] Sent: Tuesday, July 26, 2011 2:45 PM To: RICHARD METZER; snort-users () lists sourceforge net Subject: Re: [Snort-users] Reload Snort to use new ruleset The command "kill -SIGHUP <pid>" has not worked for some time withSnortIIRC (nor pkill, which I had been using before) and the suggestedinit.dentry for controlling snort does not use it, either, but rather
stop
andstart: restart|reload) $0 stop $0 start I suspect the doc needs updating. Add in using barnyard2 and things get more interesting. Here is mycurrentcron script that uses oinkmaster (no pulledpork suggestions
please):
#!/bin/bash cd /etc/snort /sbin/service barnyard2 stop ./oinkmaster.pl -o ./rules -b ./backup -C ./bleeding-oink.conf -C ./oinkmaster.conf >oink.out 2>&1 ./create-sidmap.pl rules >sid-msg.map /sbin/service snort restart /sbin/service barnyard2 start -- Shane Castle Data Security Mgr, Boulder County IT CISSP GSEC GCIH -----Original Message----- From: RICHARD METZER [mailto:rlmst26 () mail rmu edu] Sent: Tuesday, July 26, 2011 14:24 To: snort-users () lists sourceforge net Subject: [Snort-users] Reload Snort to use new ruleset I understand the command kill -SIGHUP <pid> should reload Snort
with
theability to read an updated ruleset. However, it only seems to killit. Iam manually adding new rules, so I would like to reload Snort to avoidanydowntime monitoring. I used the -enable-reload switch when I compiledSnorton an Ubuntu OS. What am I missing? Thanks in advance, Rick As I understand the command kill -SIGHUP <pid> should reload Snortwith theability to read an updated ruleset; however, it only seems to kill
it.
I ammanually adding new rules, so I would like to reload Snort to avoidanydowntime monitoring. I used the --enable-reload switch when IcompiledSnort. What am I missing? Thanks in advance! Rick
----------------------------------------------------------------------
-- ------ Got Input? Slashdot Needs You. Take our quick survey online. Come on, we don't ask for help
often.
Plus, you'll get a chance to win $100 to spend on ThinkGeek. http://p.sf.net/sfu/slashdot-survey _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users Please see http://www.snort.org/docs for documentation
------------------------------------------------------------------------ --
----Got Input? Slashdot Needs You. Take our quick survey online. Come on, we don't ask for help often. Plus, you'll get a chance to win $100 to spend on ThinkGeek. http://p.sf.net/sfu/slashdot-survey _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users Please see http://www.snort.org/docs for documentation
------------------------------------------------------------------------------ Got Input? Slashdot Needs You. Take our quick survey online. Come on, we don't ask for help often. Plus, you'll get a chance to win $100 to spend on ThinkGeek. http://p.sf.net/sfu/slashdot-survey _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users Please see http://www.snort.org/docs for documentation
Current thread:
- Reload Snort to use new ruleset RICHARD METZER (Jul 26)
- Re: Reload Snort to use new ruleset Gibson, Nathan J. (HSC) (Jul 26)
- Re: Reload Snort to use new ruleset Eoin Miller (Jul 26)
- Re: [Spam] Reload Snort to use new ruleset Lay, James (Jul 26)
- Re: Reload Snort to use new ruleset Castle, Shane (Jul 26)
- Re: Reload Snort to use new ruleset Marcos Rodriguez (Jul 26)
- Re: Reload Snort to use new ruleset Lay, James (Jul 26)
- Re: Reload Snort to use new ruleset Joel Esler (Jul 26)
- Re: Reload Snort to use new ruleset Lay, James (Jul 26)
- Re: Reload Snort to use new ruleset Paul Schmehl (Jul 28)
- Re: Reload Snort to use new ruleset Gibson, Nathan J. (HSC) (Jul 26)
- Re: Reload Snort to use new ruleset Agustin Roca (Jul 27)
- <Possible follow-ups>
- Re: Reload Snort to use new ruleset Gregory Zill (Jul 26)