[Snort-devel] config quiet not working

Martin Roesch roesch at ...402...
Sat Mar 20 21:09:02 EDT 2010


They set the same internal flags, one does it when the command line is
parsed and the other does it when the snort.conf is parsed.  The docs should
probably be updated to reflect that point.

Marty

On Sat, Mar 20, 2010 at 3:05 PM, Lee Clemens <snort at ...2953...> wrote:

> That does seem to be the behavior I am seeing, but the manual shows "config
> quiet" and "snort -q" as being the same.
>
> Maybe the documentation should not show these two as equivalent?  (I will
> test again on another environment on Monday, I thought config quiet got rid
> of the message below as well and -q was not necessary, but I need to
> confirm).
>
> -----Original Message-----
> From: Martin Roesch [mailto:roesch at ...402...]
> Sent: Saturday, March 20, 2010 2:26 PM
>
> IIRC the snort.conf is loaded after a bunch of subsystems initialize,
> once it's loaded Snort should be quiet but until then the switch
> hasn't been set. If you want quiet-mode from the get go use the -q
> switch.
>
> Marty
>
>
> On Saturday, March 20, 2010, Lee Clemens <snort at ...2953...> wrote:
> > Hello,
> >
> > I am running Snort 2.8.5.3 on Linux Kernel 2.6.x.
> >
> > My snort.conf contains "config quiet" and I am using -c <snort.conf path>
> to
> > start.
> >
> > However, unless I use -q on the command line, I see startup info,
> starting
> > with (I would think config quiet would eliminate the need to use -q):
> >
> > Running in IDS mode
> >
> >         --== Initializing Snort ==--
> > Initializing Output Plugins!
> > <snip>
> >
> > Thanks,
> > Lee
> >
> >
> >
> >
>
> ----------------------------------------------------------------------------
> --
> > Download Intel® Parallel Studio Eval
> > Try the new software tools for yourself. Speed compiling, find bugs
> > proactively, and fine-tune applications for parallel performance.
> > See why Intel Parallel Studio got high marks during beta.
> > http://p.sf.net/sfu/intel-sw-dev
> > _______________________________________________
> > Snort-devel mailing list
> > Snort-devel at lists.sourceforge.net
> > https://lists.sourceforge.net/lists/listinfo/snort-devel
> >
>
> --
> Martin Roesch - Founder/CTO, Sourcefire Inc. - +1-410-290-1616
> Sourcefire - Security for the Real World - http://www.sourcefire.com
> Snort: Open Source IDP - http://www.snort.org
>
>
>


-- 
Martin Roesch - Founder/CTO, Sourcefire Inc. - +1-410-290-1616
Sourcefire - Security for the Real World - http://www.sourcefire.com
Snort: Open Source IDP - http://www.snort.org
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-devel/attachments/20100320/8e26d61e/attachment.html>


More information about the Snort-devel mailing list