Jason Haar wrote:
Colin Grady wrote:
I've migrated one system from Snort 2.6.0.2 <http://2.6.0.2> to Snort
2.6.1. I've made no configuration file changes and no command-line
changes between the two releases, but after somewhere around 20-30
minutes after being started Snort 2.6.1 seems to stop logging data.
I'm using unified logging, which is being processed through Barnyard.
The Snort process continues to run and the processor time continues to
climb, but the unified logs stop growing -- so it's not related to
Barnyard as best as I can tell.
Anyone else seen anything like this?
I think this is a "me too". I've just noticed that 2.6.1RC1 appears to
work initially, but stops logging at some later time. I am just
upgrading to 2.6.1 to see if that fixes it - but your report implies it
won't. We're using both syslog and mysql output modules - and both stop
reporting - so that (plus your barnyard report) implies the problem is
occurring somewhere earlier on.
This is snort-2.6.1RC1 under CentOS4.4
"Me too" here, also with a CentOS 4.4 and Snort 2.6.1, I have a problem
with logging. Some time after the daemon start, snort consumes all CPU,
and stop logging. "kill" don't work, "kill -9" works.
With Snort 2.6.0.2, all works OK. I'm using 2.6.0.2 because of this.
Julio.
-------------------------------------------------------------------------
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net's Techsay panel and you'll get the chance to share your
opinions on IT & business topics through brief surveys - and earn cash
http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
