Re: Reload Snort to use new ruleset

["Gibson, Nathan J. (HSC)" <Nathan-Gibson () ouhsc edu>]

I have found this only works when running snort as root. Are you running snort as root?

From: RICHARD METZER [mailto:rlmst26 () mail rmu edu]
Sent: Tuesday, July 26, 2011 3:24 PM
To: snort-users () lists sourceforge net
Subject: [Snort-users] Reload Snort to use new ruleset

I understand the command kill -SIGHUP <pid> should reload Snort with the ability to read an updated ruleset.  However, 
it only seems to kill it.  I am manually adding new rules, so I would like to reload Snort to avoid any downtime 
monitoring.  I used the -enable-reload switch when I compiled Snort on an Ubuntu OS.  What am I missing?

Thanks in advance,
Rick







As I understand the command kill -SIGHUP <pid> should reload Snort with the ability to read an updated ruleset; 
however, it only seems to kill it.  I am manually adding new rules, so I would like to reload Snort to avoid any 
downtime monitoring.  I used the --enable-reload switch when I compiled Snort. What am I missing?

Thanks in advance!
Rick


------------------------------------------------------------------------------
Got Input?   Slashdot Needs You.
Take our quick survey online.  Come on, we don't ask for help often.
Plus, you'll get a chance to win $100 to spend on ThinkGeek.
http://p.sf.net/sfu/slashdot-survey

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users

Please see http://www.snort.org/docs for documentation