Snort mailing list archives
RE: Question involving segmentation fault
From: Chip Kelly <Chip.Kelly () sas com>
Date: Wed, 6 Feb 2002 13:04:49 -0500
FWIW, I've experienced the same behavior, running 1.8.3 on RH7.1, using libpcap 0.6.2. It doesn't happen every time I stop snort with the kill command, but on a high percentage of the times that I actually stop the process. Now that I have been enlightened with the kill -HUP signal to cause snort to pause and pick up rule modifications, I tend to leave snort running for much longer periods of time. -chip -----Original Message----- From: Phil Wood [mailto:cpw () lanl gov] Sent: Wednesday, February 06, 2002 12:08 PM To: snort-users () lists sourceforge net Subject: [Snort-users] Question involving segmentation fault Folks, I've got a re-occuring problem to do with signal handling in snort. It has happened at one time or another with ever version up to the current (1.8.4-beta1). And that is, sometimes when I send a TERM signal to the snort process, it will segmentation fault. This doesn't occur always, but usually after a realtively long run (24 hours). I restart the snort process every 24 hours by issuing the kill command. The process is encapsulated in a shell script which packages up the results, moves any core files to a unique name, and restarts the snort process. I even tried using the tcpdump signal handling stuff to see if it might be some bollixed up linux libc library problem. However, nothing I've done has made any difference. It happens on redhat? and debian potato linux systems. It could be some problem I've introduced through my own munging. But, I just thought I'd ask and see if anyone else is seeing this problem. Thanks, Phil _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Question involving segmentation fault Phil Wood (Feb 06)
- Re: Question involving segmentation fault Phil Wood (Feb 08)
- <Possible follow-ups>
- RE: Question involving segmentation fault Chip Kelly (Feb 06)