Re: Snort dies after a few days.

[Bill McCarty <bmccarty () apu edu>]

Under RHL 7.2, a minor hack is needed to get the core dump. Change 
/etc/rc.d/init.d/functions from:

       # make sure it doesn't core dump anywhere; while this could mask
       # problems with the daemon, it also closes some security problems 

       ulimit -S -c 0 >/dev/null 2>&1

to:

       # make sure it doesn't core dump anywhere; while this could mask
       # problems with the daemon, it also closes some security problems 

       if [ "$0" == "/etc/init.d/snortd" ]
       then
         ulimit -c 10000000
       else
         ulimit -S -c 0 >/dev/null 2>&1
       fi

Cheers,

---------------------------------------------------
Bill McCarty

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users