[Snort-devel] Snort 2.4.3 perfmonitor not finishing log entries properly
steve.sturges at ...402...
Fri Mar 3 08:32:00 EST 2006
This relates to the issue that the signal handlers were
causing snort to exit immediately. Assuming the
signal isn't a SEGV in writing the data, that is
easily addressed (will be in the next release of snort).
If you kill -9 the snort process, all bets are off. :)
Alex Butcher wrote:
> Hi -
> Sometimes, the perfmonitor pre-processor in 2.4.3 doesn't finish its log
> entries properly (presumably when snort gets killed or dies), leading to
> lines with the wrong number of fields. Couldn't snort do some signal
> trapping and make sure it finishes log entries before it dies?
More information about the Snort-devel