--On Saturday, May 21, 2005 9:08 PM -0700 mahboobeh soleimani
<mah_soleimani@yahoo.com> wrote:
I installed Snort on my system and started it with this command : "snort
-i eth1" and the traffic which it processes was about 4 Mbit/sec but
during the night ,when traffic is not very much ,it gets restarted and
will start with this command: "/usr/sbin/snort -A fast -b -d -D -i eth1
-u snort -g snort -c /etc/snort/snort.conf -l /var/log/snort" as you can
see it restarts with some predefined switches and will capture packets
(instead of eth1) on eth0 by default.
Would you please guide me what is the reason of getting restarted of
Snort and on the other hand where the restart command is tuned in Snort's
config files?
Best Regards.
You're using some version of Unix (probably Linux?), and the snort log
files are being turned over every night. In a "standard" Unix setup, when
the log files are turned over, the system HUP's the server.
You don't say what OS you're using, so it's really difficult to say where,
but you probably have a startup script somewhere that syslog is using to
restart the server. The startup script would have the switches that you're
seeing in it.
Paul Schmehl (pauls@utdallas.edu)
Adjunct Information Security Officer
University of Texas at Dallas
AVIEN Founding Member
http://www.utdallas.edu/
-------------------------------------------------------
This SF.Net email is sponsored by Oracle Space Sweepstakes
Want to be the first software developer in space?
Enter now for the Oracle Space Sweepstakes!
http://ads.osdn.com/?ad_id=7412&alloc_id=16344&op=click
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
