[Snort-devel] config pidpath directive no longer valid?

Steven Sturges steve.sturges at ...402...
Fri Mar 21 08:49:47 EDT 2008


Thanks, Lee.

Per the documentation, the --pid-path command-line argument
is the directory specified.

I'll consider this issue closed.

Cheers.
-steve

Lee Clemens wrote:
> Hi Steve,
> 
> The change in the syslogs after compiling with the diff was this (Mar 20)
> (surrounded by the old logs, since they were identical):
> 
> Mar 16 13:53:30 myhost snort: WARNING: /<mypidpath>/snort_eth0.pid is
> invalid, trying /var/run...
> Mar 20 20:08:51 myhost snort: Previous Error, errno=2, (No such file or
> directory)
> Mar 16 13:53:30 myhost snort: PID path stat checked out ok, PID path set to
> /var/run/
> 
> The pid-path I supplied to receive this error was an absolute path to a file
> which did not exist. When run with a directory, it works fine.
> 
> Hope that helps.
> 
> Kind Regards,
> Lee
> 
> 
> -----Original Message-----
> From: Steven Sturges [mailto:steve.sturges at ...402...] 
> Sent: Monday, March 17, 2008 12:38 PM
> To: Lee Clemens
> Cc: 'Snort Developers Postings'; bugs at ...835...
> Subject: Re: [Snort-devel] config pidpath directive no longer valid?
> 
> Hi Lee--
> 
> The only two checks that are made are that the path is a
> directory and that directory is writable.
> 
> I'm wondering if the stat() command that is used to determine
> if the path is a directory is failing (just noticed the error
> code for it is not checked).
> 
> Per the stat() manpage, each directory in the path must have
> execute permission.
> 
> I've attached a patch against 2.8.1 RC that prints out the error
> info that might help you diagnose the problem.  Should apply to
> 2.8.0 (or easy to adapt if it does not).
> 
> Cheers
> -steve
> 
> Lee Clemens wrote:
>> I have used --pid-path <mypidpath> as a command-line option, where
>> <mypidpath> is a directory in which to write the pid file.
>>
>> However, I receive the following errors during start():
>>
>> Mar 16 13:53:30 myhost snort: Initializing daemon mode
>> Mar 16 13:53:30 myhost snort: Parent waiting for child...
>> Mar 16 13:53:30 myhost snort: WARNING: /<mypidpath>/snort_eth0.pid is
>> invalid, trying /var/run...
>> Mar 16 13:53:30 myhost snort: PID path stat checked out ok, PID path set
> to
>> /var/run/
>> Mar 16 13:53:30 myhost snort: Writing PID "4609" to file
>> "/var/run//snort_eth0.pid"
>> Mar 16 13:53:30 myhost snort: Signaling parent 4607 from child 4609
>> Mar 16 13:53:30 myhost snort: Daemon initialized, signaled parent pid:
> 4607
>> Mar 16 13:53:30 myhost snort: Received Signal from Child
>> Mar 16 13:53:30 myhost snort: Daemon parent exiting
>>
>>
>> I have confirmed <mypidpath> is an absolute path, and root has rwx
>> permission on the entire tree, so I'm not sure why snort thinks it is
>> invalid.
>>
>>
>> --Lee
>>
>> -----Original Message-----
>> From: Steven Sturges [mailto:steve.sturges at ...402...] 
>> Sent: Monday, March 10, 2008 9:00 AM
>> To: Lee Clemens
>> Cc: bugs at ...835...; 'Snort Developers Postings'
>> Subject: Re: [Snort-devel] config pidpath directive no longer valid?
>>
>> Hi Lee--
>>
>> The config directive pidpath has been compiled out of the code for
>> some time, at least since 2.6.1.  We'll try to get the docs updated
>> to reflect that.
>>
>> However, it is supported on the commandline, you can use the
>> --pid-path option and specify the path.
>>
>> Depending on your other options (for example, if you daemonize,
>> messages go to syslog).  To test a configuration without daemonization,
>> use -T on the commandline.
>>
>> Cheers.
>> -steve
>>
>> Lee Clemens wrote:
>>> Hello all,
>>>
>>> I am trying to run 2.8.0.2 with the following config directive defined in
>> my
>>> snort.conf:
>>> config pidpath: /applogs/snort/run
>>>
>>> But when starting Snort, I receive this in my syslogs:
>>> FATAL ERROR: Unknown config directive: config pidpath: /applogs/snort/run
>>>
>>> No errors are printed to STDOUT.
>>>
>>> I checked the snort_manual (v2.7.0 comes with the VRT rules released on
>>> 3-6-2008, by the way) and the config directive, pidpath, <i>is</i>
>>> explicitly defined in both the 2.7.0 and 2.8.0 Snort Manuals.
>>>
>>> Is this a documentation error, or is 2.8.0.2 no longer recognizing
> "config
>>> pidpath"?
>>>
>>> I can provide any system specific information if it would be useful.
>>>
>>> As a side note: 
>>> 	I think it would be helpful if this fatal error was printed to
>>> STDOUT, instead of a FATAL ERROR <i>only</i> being printed to syslog.
>>
>>
>>
>> -------------------------------------------------------------------------
>> This SF.net email is sponsored by: Microsoft
>> Defy all challenges. Microsoft(R) Visual Studio 2008.
>> http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
>> _______________________________________________
>> Snort-devel mailing list
>> Snort-devel at lists.sourceforge.net
>> https://lists.sourceforge.net/lists/listinfo/snort-devel
>>
> 
> 
> 




More information about the Snort-devel mailing list