Re: Snort dies after a few days.

[Phil Wood <cpw () lanl gov>]

All bets are off if you run RedHat.  They do it their way, tcpdump.org does
it their way, and I do it my way.

I've had some offline discussion with tcpdump.org folks.  It is unlikely
that there will be any changes to the feeble linux aspects of libpcap in
the near future.  If (on LINUX) you want large pcap files, and have no
aversion to building your own libpcap, sandwich the following:

#ifdef linux
#define _FILE_OFFSET_BITS 64
#define _LARGEFILE64_SOURCE
#endif

between the test/#include for a config.h file and the next #include file.

Then recompile, and rebuild your tcpdump applications using the resulting
libpcap.a.

On Mon, Mar 25, 2002 at 11:47:11AM -0800, Bill McCarty wrote:
> My Snort dies when a binary log file reaches a bit over 2 GB. I thought RHL 
> 7.2 and the 2.4 kernel allowed files to exceed this limit, but apparently 
> not. I'll check further when I get the version of Snort that I just 
> compiled to properly generate alerts <grin>.
>
> ---------------------------------------------------
> Bill McCarty

-- 
Phil Wood, cpw () lanl gov


_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users