[Snort-devel] config pidpath directive no longer valid?
snort at ...2953...
Sun Mar 16 13:59:24 EDT 2008
I have used --pid-path <mypidpath> as a command-line option, where
<mypidpath> is a directory in which to write the pid file.
However, I receive the following errors during start():
Mar 16 13:53:30 myhost snort: Initializing daemon mode
Mar 16 13:53:30 myhost snort: Parent waiting for child...
Mar 16 13:53:30 myhost snort: WARNING: /<mypidpath>/snort_eth0.pid is
invalid, trying /var/run...
Mar 16 13:53:30 myhost snort: PID path stat checked out ok, PID path set to
Mar 16 13:53:30 myhost snort: Writing PID "4609" to file
Mar 16 13:53:30 myhost snort: Signaling parent 4607 from child 4609
Mar 16 13:53:30 myhost snort: Daemon initialized, signaled parent pid: 4607
Mar 16 13:53:30 myhost snort: Received Signal from Child
Mar 16 13:53:30 myhost snort: Daemon parent exiting
I have confirmed <mypidpath> is an absolute path, and root has rwx
permission on the entire tree, so I'm not sure why snort thinks it is
From: Steven Sturges [mailto:steve.sturges at ...402...]
Sent: Monday, March 10, 2008 9:00 AM
To: Lee Clemens
Cc: bugs at ...835...; 'Snort Developers Postings'
Subject: Re: [Snort-devel] config pidpath directive no longer valid?
The config directive pidpath has been compiled out of the code for
some time, at least since 2.6.1. We'll try to get the docs updated
to reflect that.
However, it is supported on the commandline, you can use the
--pid-path option and specify the path.
Depending on your other options (for example, if you daemonize,
messages go to syslog). To test a configuration without daemonization,
use -T on the commandline.
Lee Clemens wrote:
> Hello all,
> I am trying to run 18.104.22.168 with the following config directive defined in
> config pidpath: /applogs/snort/run
> But when starting Snort, I receive this in my syslogs:
> FATAL ERROR: Unknown config directive: config pidpath: /applogs/snort/run
> No errors are printed to STDOUT.
> I checked the snort_manual (v2.7.0 comes with the VRT rules released on
> 3-6-2008, by the way) and the config directive, pidpath, <i>is</i>
> explicitly defined in both the 2.7.0 and 2.8.0 Snort Manuals.
> Is this a documentation error, or is 22.214.171.124 no longer recognizing "config
> I can provide any system specific information if it would be useful.
> As a side note:
> I think it would be helpful if this fatal error was printed to
> STDOUT, instead of a FATAL ERROR <i>only</i> being printed to syslog.
More information about the Snort-devel