Snort mailing list archives
Re: PID file
From: Nick Kraal <nick () arc net my>
Date: Wed, 30 Oct 2002 23:54:33 +0800
Thanks for your reply. I am using the following command to run the process as daemon: /usr/local/bin/snort -di eth1 -h 192.168.100.0/24 -l /var/log/snort -c /etc/snort/snort.conf -s -D But it looks like Snort runs but does not seem to be running as daemon in the background. I can see the process run from the "ps -ef" output and get the following output and just sits there and no pid file is created. Regards, -nick/ --------------------------------------------------- Initializing Output Plugins! Log directory = /var/log/snort Initializing Network Interface eth1 Kernel filter, protocol ALL, raw packet socket --== Initializing Snort ==-- Decoding Ethernet on interface eth1 Initializing Preprocessors! Initializing Plug-ins! Parsing Rules file /etc/snort/snort.conf +++++++++++++++++++++++++++++++++++++++++++++++++++ Initializing rule chains... No arguments to frag2 directive, setting defaults to: Fragment timeout: 60 seconds Fragment memory cap: 4194304 bytes Fragment min_ttl: 0 Fragment ttl_limit: 5 Fragment Problems: 0 Stream4 config: Stateful inspection: ACTIVE Session statistics: INACTIVE Session timeout: 30 seconds Session memory cap: 8388608 bytes State alerts: INACTIVE Evasion alerts: INACTIVE Scan alerts: ACTIVE Log Flushed Streams: INACTIVE MinTTL: 1 TTL Limit: 5 Async Link: 0 No arguments to stream4_reassemble, setting defaults: Reassemble client: ACTIVE Reassemble server: INACTIVE Reassemble ports: 21 23 25 53 80 143 110 111 513 Reassembly alerts: ACTIVE Reassembly method: FAVOR_OLD http_decode arguments: Unicode decoding IIS alternate Unicode decoding IIS double encoding vuln Flip backslash to slash Include additional whitespace separators Ports to decode http on: 80 rpc_decode arguments: Ports to decode RPC on: 111 32771 telnet_decode arguments: Ports to decode telnet on: 21 23 25 119 Conversation Config: KeepStats: 0 Conv Count: 32000 Timeout : 60 Alert Odd?: 0 Allowed IP Protocols: All Portscan2 config: log: /var/log/snort/scan.log scanners_max: 3200 targets_max: 5000 target_limit: 5 port_limit: 20 timeout: 60 1474 Snort rules read... 1474 Option Chains linked into 171 Chain Headers 0 Dynamic rules +++++++++++++++++++++++++++++++++++++++++++++++++++ Rule application order: ->activation->dynamic->alert->pass->log --== Initialization Complete ==-- -*> Snort! <*- Version 1.9.0 (Build 209) By Martin Roesch (roesch () sourcefire com, www.snort.org) ----- Original Message ----- From: "Alberto Gonzalez" <ag-snort () cerebro violating us> To: "Nick Kraal" <nick () arc net my> Sent: Thursday, October 31, 2002 2:34 AM Subject: Re: [Snort-users] PID file
I'm running Snort 1.9.0beta6 on OpenBSD 3.1 (albertg@cerebro)(~) ps -aux |grep snort root 14183 0.0 24.5 46096 15980 ?? Ss Mon12AM 2:44.66 /usr/local/bin/snort -h 68.50.189.203/32 -d -c /etc/snort/snort.conf -D (albertg@cerebro)(~) ls -lag /var/run |grep snort -rw------- 1 root wheel 6 Oct 28 00:12 snort_fxp0.pid -rw------- 1 root wheel 5 Oct 16 00:27 snort_rl0.pid Check your 'ps -aux' output to see if snort is trully running, because if it is, then the PID is there. Nick Kraal wrote:just upgraded our Snort from a 1.8x to 1.9. But I find the pid file not created. Used to be in /var/run/ but this is not created anymore or am I missing something. Any ideas? Thanks in advance. Regards, -nick/-- The secret to success is to start from scratch and keep on scratching.
------------------------------------------------------- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http://thinkgeek.com/sf _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- snort as IDS Anuradha Gupta (Oct 30)
- Re: snort as IDS pix (Oct 30)
- PID file Nick Kraal (Oct 30)
- Message not available
- Re: PID file Nick Kraal (Oct 30)
- Re: PID file Andrew R. Baker (Oct 30)
- Re: PID file Nick Kraal (Oct 30)
- Message not available
- <Possible follow-ups>
- RE: snort as IDS Christopher Lyon (Oct 30)