Snort mailing list archives
Re: snort 2.8.2.1 stops logging after 1 minute...
From: "Frank Reid" <fcreid () ourcorner org>
Date: Mon, 21 Jul 2008 17:59:23 -1000
I'm out of the area for a week or so, but would appreciate anyone's feedback on whether this addresses the issues we've been seeing. Frank -----Original Message----- From: snort-users-bounces () lists sourceforge net [mailto:snort-users-bounces () lists sourceforge net] On Behalf Of craig Sent: Monday, July 21, 2008 11:52 AM To: snort-users Subject: Re: [Snort-users] snort 2.8.2.1 stops logging after 1 minute... On Mon, 2008-07-21 at 16:31 -0400, Steven Sturges wrote:
Attached is a patch to 2.8.2.1 that should address the issue. If anyone has problems with it, please let us know.
testing it out now. Thanks Steve.
Cheers. -steve Tim Maletic wrote:Was glad to see this thread pop up. I'm seeing similar behavior when I attempt to move from 2.8.0 to 2.8.2. Running on RHEL4, 2.8.0 is working fine. I shutdown, copy the 2.8.2
snort
binary and libraries into place, restart, and then I get a handful of
alerts
before the load climbs to 2.5 in a minute or two. (Load under 2.8.0 is typically under 1.) Once it's in that state, no alerts fire (even while generating test alert traffic), and the snort processes don't respond to SIGUSR1 like normal. So, same config, same rulesets, but 2.8.0 runs fine and 2.8.2 tanks. (I also tried disabling my local rules under 2.8.2, and that didn't help.) -tm ------------------------------------------------------------------------
-------------------------------------------------------------------------
This SF.Net email is sponsored by the Moblin Your Move Developer's
challenge
Build the coolest Linux based applications with Moblin SDK & win great
prizes
Grand prize is a trip for two to an Open Source event anywhere in the
world
http://moblin-contest.org/redirect.php?banner_id=100&url=/ ------------------------------------------------------------------------ _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users------------------------------------------------------------------------- This SF.Net email is sponsored by the Moblin Your Move Developer's
challenge
Build the coolest Linux based applications with Moblin SDK & win great
prizes
Grand prize is a trip for two to an Open Source event anywhere in the
world
http://moblin-contest.org/redirect.php?banner_id=100&url=/ _______________________________________________ Snort-users mailing list
Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users ------------------------------------------------------------------------- This SF.Net email is sponsored by the Moblin Your Move Developer's challenge Build the coolest Linux based applications with Moblin SDK & win great prizes Grand prize is a trip for two to an Open Source event anywhere in the world http://moblin-contest.org/redirect.php?banner_id=100&url=/ _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users ------------------------------------------------------------------------- This SF.Net email is sponsored by the Moblin Your Move Developer's challenge Build the coolest Linux based applications with Moblin SDK & win great prizes Grand prize is a trip for two to an Open Source event anywhere in the world http://moblin-contest.org/redirect.php?banner_id=100&url=/ _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Re: snort 2.8.2.1 stops logging after 1 minute..., (continued)
- Re: snort 2.8.2.1 stops logging after 1 minute... JJ Cummings (Jul 16)
- Re: snort 2.8.2.1 stops logging after 1 minute... craig (Jul 16)
- Re: snort 2.8.2.1 stops logging after 1 minute... Frank Reid (Jul 16)
- Re: snort 2.8.2.1 stops logging after 1 minute... JJ Cummings (Jul 16)
- Re: snort 2.8.2.1 stops logging after 1 minute... JJ Cummings (Jul 16)
- Re: snort 2.8.2.1 stops logging after 1 minute... Matt Jonkman (Jul 16)
- Re: snort 2.8.2.1 stops logging after 1 minute... JJ Cummings (Jul 16)
- Re: snort 2.8.2.1 stops logging after 1 minute... Tim Maletic (Jul 17)
- Re: snort 2.8.2.1 stops logging after 1 minute... Steven Sturges (Jul 21)
- Re: snort 2.8.2.1 stops logging after 1 minute... craig (Jul 21)
- Re: snort 2.8.2.1 stops logging after 1 minute... Frank Reid (Jul 21)
- Re: snort 2.8.2.1 stops logging after 1 minute... craig (Jul 21)
- Re: snort 2.8.2.1 stops logging after 1 minute... Frank Reid (Jul 21)
- Re: snort 2.8.2.1 stops logging after 1 minute... JJ Cummings (Jul 16)
- Re: snort 2.8.2.1 stops logging after 1 minute... craig (Jul 16)
- Re: snort 2.8.2.1 stops logging after 1 minute... JJ Cummings (Jul 16)
- Re: snort 2.8.2.1 stops logging after 1 minute... craig (Jul 16)