[Snort-users] Swatch run continuously?

McCammon, Keith Keith.McCammon at ...3497...
Mon Aug 12 14:56:01 EDT 2002


If swatch is exiting and you're not receiving alerts, then you have a configuration problem, and you probably need to check your swatchrc file for errors.  The exit is probably caused by swatch trying to alert and failing.

> -----Original Message-----
> From: Sheahan, Paul (PCLN-NW) [mailto:Paul.Sheahan at ...2218...]
> Sent: Monday, August 12, 2002 5:44 PM
> To: McCammon, Keith; Snort List (E-mail)
> Subject: RE: [Snort-users] Swatch run continuously?
> 
> 
> I've found the service off a few times while testing, and 
> read somewhere
> that it is designed to alert and then shutdown afterward. Not 
> sure if this
> is my problem though since I didn't receive any alerts. In 
> any case, I am
> running it manually with a script at this point and just want 
> it to remain
> up all the time once I start it.
> 
> Thanks
> 
> 
> 
> -----Original Message-----
> From: McCammon, Keith [mailto:Keith.McCammon at ...3497...]
> Sent: Monday, August 12, 2002 5:27 PM
> To: Sheahan, Paul (PCLN-NW); Snort List (E-mail)
> Subject: RE: [Snort-users] Swatch run continuously?
> 
> 
> Define "shutdown like it does."  Are you starting it manually 
> or something?
> 
> > -----Original Message-----
> > From: Sheahan, Paul (PCLN-NW) [mailto:Paul.Sheahan at ...2218...]
> > Sent: Monday, August 12, 2002 5:15 PM
> > To: Snort List (E-mail)
> > Subject: [Snort-users] Swatch run continuously?
> > 
> > 
> > Hello,
> > 
> > I'm evaluating Swatch and set it up to notify me for specific 
> > alerts in my
> > Snort alert file. All seems to be working, but I don't want 
> swatch to
> > shutdown like it does. I want it to alert me when necessary 
> > via email, but
> > continue to monitor afterward (the daemon should never shut 
> > down). Does
> > anyone know how I can make it do this?
> > 
> > Thanks!
> > 
> > 
> > 
> > -------------------------------------------------------
> > This sf.net email is sponsored by: Dice - The leading 
> online job board
> > for high-tech professionals. Search and apply for tech jobs today!
> > http://seeker.dice.com/seeker.epl?rel_code=31
> > _______________________________________________
> > Snort-users mailing list
> > Snort-users at lists.sourceforge.net
> > Go to this URL to change user options or unsubscribe:
> > https://lists.sourceforge.net/lists/listinfo/snort-users
> > Snort-users list archive:
> > http://www.geocrawler.com/redir-sf.php3?list=snort-users
> > 
> 




More information about the Snort-users mailing list