[Snort-users] Snort Stopped
yonah at ...569...
Thu Apr 19 10:42:34 EDT 2001
Before you make a new filesystem to hold your log files you might try
using 'find' to look for anywhere lots of small files may have
accumulated. I've seen misconfigured Mandrake systems (it seems that they
come out of the box misconfigured) which were set to logrotate everything
in some directories which meant they rotated the previously rotated logs
as well... growth is exponential.
On Wed, 18 Apr 2001, ___cliff rayman___ wrote:
> you are using too many inodes in your file system. basically,
> you have too many individual files and there are not enough
> inode entities available to store the metadata in. i think the max
> on linux is 32,000, which is the max for a virtual file system.
> make a new fs just for snort so it will not overflow.
> this is the danger of using the fs as a database. i like to do it
> also, but i am keeping my eye on a similar problem for another
> ___cliff rayman___cliff at ...1367...://www.genwax.com/
> Daniel Paul Hart wrote:
> > Hi there, I have been successfully running Snort in Daemon mode for about a week until today.When it just stopped with this message : snort: ERROR: OpenLogFile() => mkdir(/var/log/snort/62.31.228.xxx) log directory: Too many links Can someone help me diagnose this? Cheers, Dan Hart
> > _________________________________________________
> > IncrediMail - Email has finally evolved - Click Here
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> Snort-users list archive:
Email: <yonah at ...570...>
PGP: 0x7C3C2524 <ldap://certserver.pgp.com>
"Quote me as saying I was misquoted."
More information about the Snort-users