[Snort-users] snort dies under RH7 (was) Snort website unreadable fonts

Chris Green cmg at ...671...
Mon Apr 2 13:25:17 EDT 2001


dave w capella <dave.capella at ...1712...> writes:
> 
> Supervise? is that a RH thing? (i've run slackware for the last decade.)

Nah, its a daemontools thing from http://cr.yp.to.  

> >I think Fyodor is working on snortdog which will (in the future?) do
> >this too
> 
> I just do this from cron:
> 
> 0 * * * * ps -A|grep -q snort || { /etc/init.d/snort start;mail -s 'snort restarted' root }
>
> but i hate to kludge w/o an idea of the underlying problem. :)
> 

I like the keep retrying and tell me about it later approach rather
than once every so often ;>  tcpstream is probably on by default and
it has problems with packet loss. A redesigned tcpstream2 is in CVS.
Linux can't ( in <2.4 I've been told ) report packet loss so you'll be
trying to puzzle shoot that one often on networks where CPU usage is
at/near 100%
-- 
Chris Green <cmg at ...671...>
"When the going gets weird, the weird turn pro..."
                            -- Hunter S. Thompson




More information about the Snort-users mailing list