[Snort-users] Wrong pid Saved on OpenBSD?

Crist J. Clark cjclark at ...960...
Wed Jan 3 18:22:48 EST 2001


I have noticed that when I run Snort 1.6.3p2 in daemon mode on my
OpenBSD 2.8 box, it seems to be getting the PID wrong. That is, the
file that it writes, snort_xl0.pid, in my case, contains the wrong
PID. The PID in the file does not correspond to any existing
process.

Without taking the half-hour required to figure this out from the
code, I thought that I would ask if this was a known issue or if
something was amiss with my setup.

Just to show exactly what I am doing,

  # snort -Dqd -h aaa.bbb.ccc.ddd/ee -l log/net_aaa -c net_aaa.snort net aaa.bbb.ccc.ddd/ee

The resulting PID in the ps(1) output does not match the contents of
snort_xl0.pid. Due to OpenBSD's "randomization" of PIDs, there is no
obvious correlation between the two values other than the fact they
are never the same.
-- 
Crist J. Clark                           cjclark at ...485...




More information about the Snort-users mailing list