RE: Question involving segmentation fault

[Chip Kelly <Chip.Kelly () sas com>]

FWIW, I've experienced the same behavior, running 1.8.3 on RH7.1, using libpcap 0.6.2. It doesn't happen every time I 
stop snort with the kill command, but on a high percentage of the times that I actually stop the process. Now that I 
have been enlightened with the kill -HUP signal to cause snort to pause and pick up rule modifications, I tend to leave 
snort running for much longer periods of time. -chip

-----Original Message-----
From: Phil Wood [mailto:cpw () lanl gov]
Sent: Wednesday, February 06, 2002 12:08 PM
To: snort-users () lists sourceforge net
Subject: [Snort-users] Question involving segmentation fault


Folks,

I've got a re-occuring problem to do with signal handling in snort.
It has happened at one time or another with ever version up to the current
(1.8.4-beta1).  And that is, sometimes when I send a TERM signal to
the snort process, it will segmentation fault.  This doesn't occur always,
but usually after a realtively long run (24 hours).  I restart the
snort process every 24 hours by issuing the kill command.  The process
is encapsulated in a shell script which packages up the results, moves
any core files to a unique name, and restarts the snort process. 

I even tried using the tcpdump signal handling stuff to see if it might
be some bollixed up linux libc library problem. However, nothing I've done
has made any difference.  It happens on redhat? and debian potato linux 
systems.  It could be some problem I've introduced through my own munging.
But, I just thought I'd ask and see if anyone else is seeing this problem.

Thanks,

Phil

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users