Snort mailing list archives

keeping threshold state


From: sekure <sekure () gmail com>
Date: Tue, 8 Nov 2005 13:05:44 -0500

I know this currently isn't possible, but is the following request on
the roadmap?

Whenever i change snort.conf or any rule file and want to reload
snort, i kill -HUP it.  This loses the state of thresholds i've
defined, so if i've defined an alert to only show up once every 24
hours (like the malware alerts from bleeding-snort), it'll show up
again.  It would be nice if there was another way to get snort to
re-read the config file, but not loose state of thresholds.

thanks


-------------------------------------------------------
SF.Net email is sponsored by:
Tame your development challenges with Apache's Geronimo App Server. Download
it for free - -and be entered to win a 42" plasma tv or your very own
Sony(tm)PSP.  Click here to play: http://sourceforge.net/geronimo.php
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users


Current thread: