The better questions:
Are you trying to run ALL SIGNATURES (including bleeding threats, and the
Stormworm IP Signatures, about 15,000 signatures)??
How much bandwidth is this firewall handling? (Mb/s)
Run Snort in non-daemon mode, and see the error you get when it stops running.
Shirkdog
' or 1=1--
http://www.shirkdog.us
Date: Thu, 6 Sep 2007 12:20:32 -0400
From: joel.esler@sourcefire.com
To: titanyen2000@yahoo.com; snort-users@lists.sourceforge.net
Subject: Re: [Snort-users] snort keeps dying!!!
We'll probably need some kind of debug output to find out why it's dying
since it's not printing any error messages.
Are you running out of RAM on the box when Snort dies?
J
On 9/6/07 12:16 PM, "Zakai Kinan" <titanyen2000@yahoo.com> mentioned to me:
The firewall is using Debian Etch 4.1. It is a Dell
PE 2950. I have nothing in the logs. Version 2.6.1.5
worked fine until I upgraded to latest version.
ZK
--- Joel Esler <joel.esler@sourcefire.com> wrote:
What OS? What hardware? Do you have anything in
your system log?
Joel
On 9/6/07 11:57 AM, "Zakai Kinan"
<titanyen2000@yahoo.com> mentioned to me:
I just upgraded from 2.6.1.5 to 2.7.0.1 and now
snort
keeps dying with no error messages. I am using
snortsam, flex_resp2, and react. I have lowered
the
memory config to lowmem. The firewall has two
cpus
and 4GB of ram. I start the daemaon and 2 minutes
later it stops suddenly. Has anyone else
encounter
this problem?
TIA,
ZK
______________________________________________________________________________
______
Need a vacation? Get great deals
to amazing places on Yahoo! Travel.
http://travel.yahoo.com/
-------------------------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems?
Stop.
Now Search log events and configuration files
using AJAX and a browser.
Download your FREE copy of Splunk now >>
http://get.splunk.com/
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or
unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
--
joel esler | security consultant | Sourcefire | pgp
is public
______________________________________________________________________________
______
Shape Yahoo! in your own image. Join our Network Research Panel today!
http://surveylink.yahoo.com/gmrs/yahoo_panel_invite.asp?a=7
-------------------------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems? Stop.
Now Search log events and configuration files using AJAX and a browser.
Download your FREE copy of Splunk now >> http://get.splunk.com/
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
--
joel esler | security consultant | Sourcefire | pgp is public
-------------------------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems? Stop.
Now Search log events and configuration files using AJAX and a browser.
Download your FREE copy of Splunk now >> http://get.splunk.com/
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
_________________________________________________________________
Connect to the next generation of MSN Messenger
http://imagine-msn.com/messenger/launch80/default.aspx?locale=en-us&source=wlmailtagline
-------------------------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems? Stop.
Now Search log events and configuration files using AJAX and a browser.
Download your FREE copy of Splunk now >> http://get.splunk.com/
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
