I'm out of the area for a week or so, but would appreciate anyone's feedback
on whether this addresses the issues we've been seeing.
Frank
-----Original Message-----
From: snort-users-bounces@lists.sourceforge.net
[mailto:snort-users-bounces@lists.sourceforge.net] On Behalf Of craig
Sent: Monday, July 21, 2008 11:52 AM
To: snort-users
Subject: Re: [Snort-users] snort 2.8.2.1 stops logging after 1 minute...
On Mon, 2008-07-21 at 16:31 -0400, Steven Sturges wrote:
Attached is a patch to 2.8.2.1 that should address the issue.
If anyone has problems with it, please let us know.
testing it out now.
Thanks Steve.
Cheers.
-steve
Tim Maletic wrote:
Was glad to see this thread pop up. I'm seeing similar behavior when I
attempt to move from 2.8.0 to 2.8.2.
Running on RHEL4, 2.8.0 is working fine. I shutdown, copy the 2.8.2
snort
binary and libraries into place, restart, and then I get a handful of
alerts
before the load climbs to 2.5 in a minute or two. (Load under 2.8.0 is
typically under 1.) Once it's in that state, no alerts fire (even while
generating test alert traffic), and the snort processes don't respond to
SIGUSR1 like normal.
So, same config, same rulesets, but 2.8.0 runs fine and 2.8.2 tanks. (I
also tried disabling my local rules under 2.8.2, and that didn't help.)
-tm
------------------------------------------------------------------------
-------------------------------------------------------------------------
This SF.Net email is sponsored by the Moblin Your Move Developer's
challenge
Build the coolest Linux based applications with Moblin SDK & win great
prizes
Grand prize is a trip for two to an Open Source event anywhere in the
world
http://moblin-contest.org/redirect.php?banner_id=100&url=/
------------------------------------------------------------------------
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
-------------------------------------------------------------------------
This SF.Net email is sponsored by the Moblin Your Move Developer's
challenge
Build the coolest Linux based applications with Moblin SDK & win great
prizes
Grand prize is a trip for two to an Open Source event anywhere in the
world
http://moblin-contest.org/redirect.php?banner_id=100&url=/
_______________________________________________ Snort-users mailing list
Snort-users@lists.sourceforge.net Go to this URL to change user options or
unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
-------------------------------------------------------------------------
This SF.Net email is sponsored by the Moblin Your Move Developer's challenge
Build the coolest Linux based applications with Moblin SDK & win great
prizes
Grand prize is a trip for two to an Open Source event anywhere in the world
http://moblin-contest.org/redirect.php?banner_id=100&url=/
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
-------------------------------------------------------------------------
This SF.Net email is sponsored by the Moblin Your Move Developer's challenge
Build the coolest Linux based applications with Moblin SDK & win great prizes
Grand prize is a trip for two to an Open Source event anywhere in the world
http://moblin-contest.org/redirect.php?banner_id=100&url=/
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
