Re: restart snort after pulledpork updates ?

[Eugeniu Babin <eugen.babin () gmail com>]

Hi Joel,
Thank You for Your replay.
Unfortunately snort command is not accepting --reload parameter.
I'm using 2.9.7 version.
And I run SNORT in daemon mode.
If I want to check daily rules updates using pulled pork then I have to
automate somehow the restart of SNORT process, which will became more
complicated when I'll monitor more interfaces.
Could You please explain what did You mean by -- reload option after pulled
pork finished his updates.

Many Thanks,
Eugene


> It is possible to just issue Snort a --reload if no shared object rules
> have been changed.
>
> --
> Joel Esler
> Sent from my iPhone
>
> > On Jan 21, 2015, at 9:56 PM, waldo kitty <wkitty42 () windstream net>
> wrote:
> > > On 1/21/2015 1:20 PM, Eugeniu Babin wrote:
> > >
> > > Should I restart snort process always after pulledpork updated the
> ruleset ?
> > yes... you have to to get it to reread the new and changed rules...
> >
> > --
> >  NOTE: No off-list assistance is given without prior approval.
> >        Please *keep mailing list traffic on the list* unless
> >        private contact is specifically requested and granted.
> ------------------------------------------------------------------------------
> > New Year. New Location. New Benefits. New Data Center in Ashburn, VA.
> > GigeNET is offering a free month of service with a new server in Ashburn.
> > Choose from 2 high performing configs, both with 100TB of bandwidth.
> > Higher redundancy.Lower latency.Increased capacity.Completely compliant.
> > http://p.sf.net/sfu/gigenet
> > _______________________________________________
> > Snort-users mailing list
> > Snort-users () lists sourceforge net
> > Go to this URL to change user options or unsubscribe:
> > https://lists.sourceforge.net/lists/listinfo/snort-users
> > Snort-users list archive:
> > http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users
> >
> > Please visit http://blog.snort.org to stay current on all the latest
> Snort news!
> -------------- next part --------------
> An HTML attachment was scrubbed...
> -------------- next part --------------
> A non-text attachment was scrubbed...
> Name: smime.p7s
> Type: application/pkcs7-signature
> Size: 2322 bytes
> Desc: not available
>
> ------------------------------
>
>
> ------------------------------------------------------------------------------
> New Year. New Location. New Benefits. New Data Center in Ashburn, VA.
> GigeNET is offering a free month of service with a new server in Ashburn.
> Choose from 2 high performing configs, both with 100TB of bandwidth.
> Higher redundancy.Lower latency.Increased capacity.Completely compliant.
> http://p.sf.net/sfu/gigenet
>
> ------------------------------
>
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> https://lists.sourceforge.net/lists/listinfo/snort-users
>
>
> End of Snort-users Digest, Vol 104, Issue 37
> ********************************************
------------------------------------------------------------------------------
New Year. New Location. New Benefits. New Data Center in Ashburn, VA.
GigeNET is offering a free month of service with a new server in Ashburn.
Choose from 2 high performing configs, both with 100TB of bandwidth.
Higher redundancy.Lower latency.Increased capacity.Completely compliant.
http://p.sf.net/sfu/gigenet

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!