[Snort-users] SIGHUP vs comand line restart

Steve Halligan agent33 at ...187...
Thu Nov 29 12:56:02 EST 2001


> Hello,
> 
> What is it more efficient, restart Snort with SIGHUP or
> killing+restarting from comand line?
> 
> Therefore, is it posible (with a signal, maybe) to 
> restart Snort without have to rebuild the chains (the
> two dimensional linked list used by the Detection 
> Engine) from the rules files? I think that it would 
> be more efficient.
> 
> Thanks in advance.

If you don't rebuild the rule-chains, then the point of restarting snort in
most cases, which would be to integrate rule file changes, is lost.

-Steve 




More information about the Snort-users mailing list