[Snort-users] snort exit

Skip Carter skip at ...1552...
Mon Nov 5 09:53:05 EST 2001


> hi
> does anybody knows why snort terminates itself?
> what's happening and how I can avoid it?
> 
> I need to run snort all the time.
> 
> maybe somebody already wrote kind of deamon to monitor
> snort and start it again when it dies.
> 
> Rgds
> Piotr
> 
> 
> 
> 
> 
> _______________________________________________
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users
> 


#!/bin/sh
# check_snort   verifies that snort is still running
#               restarts it if it dies
now=`date`
host=`hostname`
if [ -f /var/run/snort_fxp1.pid ]; then
        spid=`cat /var/run/snort_fxp1.pid`
        n=`ps auxw | grep $spid | grep -v "grep $spid" | wc -l`
        if [ $n -ne "1" ]; then
            rm /var/run/snort_fxp1.pid
            /usr/local/sbin/snort.init start
            echo "snort had to be restarted(A)" | /usr/bin/logger -i -p 
daemon.notice
            echo "$host had to restart(A) snort at $now" | /usr/bin/Mail 
-s"$host Snort restarted" skip at ...1552...
        fi
else
        /usr/local/sbin/snort.init start
        echo "snort had to be restarted(B)" | /usr/bin/logger -i -p 
daemon.notice
        echo "$host had to restart(B) snort at $now" | /usr/bin/Mail -s "$host 
Snort restarted" skip at ...1552...
fi
exit 0






More information about the Snort-users mailing list