[Snort-devel] Snort 2.4.3 perfmonitor not finishing log entries properly

Steven Sturges steve.sturges at ...402...
Fri Mar 3 08:32:00 EST 2006


This relates to the issue that the signal handlers were
causing snort to exit immediately.  Assuming the
signal isn't a SEGV in writing the data, that is
easily addressed (will be in the next release of snort).

If you kill -9 the snort process, all bets are off.  :)

Cheers
-steve

Alex Butcher wrote:
> Hi -
> 
> Sometimes, the perfmonitor pre-processor in 2.4.3 doesn't finish its log
> entries properly (presumably when snort gets killed or dies), leading to
> lines with the wrong number of fields. Couldn't snort do some signal
> trapping and make sure it finishes log entries before it dies?
> 
> Cheers,
> Alex.





More information about the Snort-devel mailing list