[Snort-users] Reload rules w/o restarting ?

Erek Adams erek at ...577...
Fri Oct 12 09:03:05 EDT 2001


On Fri, 12 Oct 2001, james wrote:

> Is there any way to reload rules (after making changes) without restarting
> snort ?

Well...  Yes and No.  :)  Yes, you can send it a SIGHUP and snort will reload
everything.  But, that reload is via the execv(2) system call.  Due to the way
execv(2) works, it _restarts_ snort.  So 'yes' you can reload rules w/o
manually killing and restarting snort.  But 'no' it doesn't work as you'd
wish.  :-/

See the FAQ (from CVS) and question 6.19.

-----
Erek Adams
Nifty-Type-Guy
TheAdamsFamily.Net





More information about the Snort-users mailing list