Colin Grady wrote:
I've migrated one system from Snort 2.6.0.2 <http://2.6.0.2> to Snort
2.6.1. I've made no configuration file changes and no command-line
changes between the two releases, but after somewhere around 20-30
minutes after being started Snort 2.6.1 seems to stop logging data.
I'm using unified logging, which is being processed through Barnyard.
The Snort process continues to run and the processor time continues to
climb, but the unified logs stop growing -- so it's not related to
Barnyard as best as I can tell.
Anyone else seen anything like this?
I think this is a "me too". I've just noticed that 2.6.1RC1 appears to
work initially, but stops logging at some later time. I am just
upgrading to 2.6.1 to see if that fixes it - but your report implies it
won't. We're using both syslog and mysql output modules - and both stop
reporting - so that (plus your barnyard report) implies the problem is
occurring somewhere earlier on.
This is snort-2.6.1RC1 under CentOS4.4
--
Cheers
Jason Haar
Information Security Manager, Trimble Navigation Ltd.
Phone: +64 3 9635 377 Fax: +64 3 9635 417
PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1
-------------------------------------------------------------------------
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net's Techsay panel and you'll get the chance to share your
opinions on IT & business topics through brief surveys - and earn cash
http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
