I am fairly new to Snort and have just got it up and running on Fedora Core 2.
Running in IDS mode, everything is fine and it runs all day and most of the
night until 04:02 every morning, when it crashes! I've upgraded the version of
Snort to a more up to date release but am still having this problem, so can
conclude it is something within my OS that is interfering with it. I have no
other services running except SSH and HTTP and no crontabs either. It is more
or less a fresh install.
This is the error i receive within the /var/messages log.
----------------------------------------------------------------------------------------------------------------
Oct 26 18:00:56 nt131 sshd(pam_unix)[1077]: session opened for user jim by
(uid=500)
Oct 26 18:01:21 nt131 su(pam_unix)[1122]: session opened for user root by
jim(uid=500)
Oct 26 22:18:36 nt131 sshd(pam_unix)[1681]: session opened for user root by
(uid=0)
Oct 26 22:19:06 nt131 sshd(pam_unix)[1681]: session closed for user root
Oct 27 04:02:15 nt131 su(pam_unix)[2683]: session opened for user cyrus by
(uid=0)
Oct 27 04:02:16 nt131 su(pam_unix)[2683]: session closed for user cyrus
Oct 27 04:02:19 nt131 kernel: device eth0 left promiscuous mode
Oct 27 04:02:19 nt131 snortd: snort shutdown succeeded
Oct 27 04:02:20 nt131 kernel: device eth0 entered promiscuous mode
Oct 27 04:02:20 nt131 snort: Initializing daemon mode
Oct 27 04:02:20 nt131 snort: PID path stat checked out ok, PID path set to
/var/run/
Oct 27 04:02:20 nt131 snort: Writing PID "2731" to file
"/var/run//snort_eth0.pid"
--------------------------------------------------------------------------------------------------------------
It would seem like cyrus is interefering with it in some way. Any suggestions
please?
Thanks
-------------------------------------------------------
This Newsletter Sponsored by: Macrovision
For reliable Linux application installations, use the industry's leading
setup authoring tool, InstallShield X. Learn more and evaluate
today. http://clk.atdmt.com/MSI/go/ins0030000001msi/direct/01/
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list
