[Snort-users] Snort dies after a few days.

Bill McCarty bmccarty at ...5196...
Mon Mar 25 11:14:20 EST 2002


Under RHL 7.2, a minor hack is needed to get the core dump. Change 
/etc/rc.d/init.d/functions from:

        # make sure it doesn't core dump anywhere; while this could mask
        # problems with the daemon, it also closes some security problems 

        ulimit -S -c 0 >/dev/null 2>&1

to:

        # make sure it doesn't core dump anywhere; while this could mask
        # problems with the daemon, it also closes some security problems 

        if [ "$0" == "/etc/init.d/snortd" ]
        then
          ulimit -c 10000000
        else
          ulimit -S -c 0 >/dev/null 2>&1
        fi

Cheers,

---------------------------------------------------
Bill McCarty




More information about the Snort-users mailing list