[Snort-devel] config pidpath directive no longer valid?

Lee Clemens snort at ...2953...
Tue Mar 11 01:43:15 EDT 2008

Hi Steve,

Glad to hear confirmation that it is only a documentation bug.

I am running as a daemon, and after a few other attempts to start snort I
realized that other errors were only going to syslog, so I am no longer
surprised this particular one was not printed to Stdout (after I sent the
email here). (It's started now without `config pidpath`, so all is well.)

Thank you for your response, and I will try with the commandline option
instead of the config directive for specifying the pid-path.

Kind Regards,

-----Original Message-----
From: Steven Sturges [mailto:steve.sturges at ...402...] 
Sent: Monday, March 10, 2008 9:00 AM
To: Lee Clemens
Cc: bugs at ...835...; 'Snort Developers Postings'
Subject: Re: [Snort-devel] config pidpath directive no longer valid?

Hi Lee--

The config directive pidpath has been compiled out of the code for
some time, at least since 2.6.1.  We'll try to get the docs updated
to reflect that.

However, it is supported on the commandline, you can use the
--pid-path option and specify the path.

Depending on your other options (for example, if you daemonize,
messages go to syslog).  To test a configuration without daemonization,
use -T on the commandline.


Lee Clemens wrote:
> Hello all,
> I am trying to run with the following config directive defined in
> snort.conf:
> config pidpath: /applogs/snort/run
> But when starting Snort, I receive this in my syslogs:
> FATAL ERROR: Unknown config directive: config pidpath: /applogs/snort/run
> No errors are printed to STDOUT.
> I checked the snort_manual (v2.7.0 comes with the VRT rules released on
> 3-6-2008, by the way) and the config directive, pidpath, <i>is</i>
> explicitly defined in both the 2.7.0 and 2.8.0 Snort Manuals.
> Is this a documentation error, or is no longer recognizing "config
> pidpath"?
> I can provide any system specific information if it would be useful.
> As a side note: 
> 	I think it would be helpful if this fatal error was printed to
> STDOUT, instead of a FATAL ERROR <i>only</i> being printed to syslog.

More information about the Snort-devel mailing list