Re: Why does Snort restart?

[Paul Schmehl <pauls () utdallas edu>]

--On Saturday, May 21, 2005 9:08 PM -0700 mahboobeh soleimani 
<mah_soleimani () yahoo com> wrote:
> I installed Snort on my system and started it with this command : "snort
> -i eth1" and the traffic which it processes was about 4 Mbit/sec but
> during the night ,when traffic is not very much ,it gets restarted and
> will start  with this command: "/usr/sbin/snort -A fast -b -d -D -i eth1
> -u snort -g snort -c /etc/snort/snort.conf -l /var/log/snort"  as you can
> see it restarts with some predefined switches and will capture packets
> (instead of eth1) on eth0 by default.
> Would you please guide me what is the reason of getting restarted of
> Snort and on the other hand where the restart command is tuned in Snort's
> config files?
> Best Regards.
You're using some version of Unix (probably Linux?), and the snort log 
files are being turned over every night.  In a "standard" Unix setup, when 
the log files are turned over, the system HUP's the server.

You don't say what OS you're using, so it's really difficult to say where, 
but you probably have a startup script somewhere that syslog is using to 
restart the server.  The startup script would have the switches that you're 
seeing in it.

Paul Schmehl (pauls () utdallas edu)
Adjunct Information Security Officer
University of Texas at Dallas
AVIEN Founding Member
http://www.utdallas.edu/


-------------------------------------------------------
This SF.Net email is sponsored by Oracle Space Sweepstakes
Want to be the first software developer in space?
Enter now for the Oracle Space Sweepstakes!
http://ads.osdn.com/?ad_id=7412&alloc_id=16344&op=click
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users