[Snort-users] Corrupt Snort Logging - Win32 Terminal Server 2000

Jim Robinson jim at ...10685...
Thu Dec 4 05:29:01 EST 2003


Michael,

Try this for strange.  I tried stopping snort, uninstalling it and it
failed to delete the executable.  I manually tried to delete it and it
said that it was in use.  I checked this and no process seemed to have a
lock on on it - I even used Active Ports to see if anything had failed
and was still using it via a socket and nothing.  I could rename it
though.....?  Anyway, I reinstalled it and it complained about Winpcap
so I uninstalled everything and then reinstalled everything and still no
joy.  Finally I reinstalled Winpcap one more time over the top and snort
decided to start again - with the same logging errors!

The server is less than a year old and has more than 512mb of RAM I am
sure (not my server).  I have not tried changing any components yet and
it logs to a test file only.  Pretty simple install really.  Just a note
it will run just fine during the night time it's during the day that it
seems to go crazy.  I'm still lost on this one!

:)

Jim


On Thu, 2003-12-04 at 00:03, Michael Steele wrote:
> That's bazaar... Have you tried rebooting? I know you hate too, It's been
> 214 days without a reboot on mine, not a record yet but getting there. How
> much memory do you have? When did this start to happen? Was any changes made
> just before it started to do this? Have you restarted the database? Have you
> tried to start the log over? Have you updated your NIC drivers? Have you
> tried to switch out your memory modules? Have you tried to switch out your
> NIC? Have you..... :)
> 
> Cheers...
> 
> -The WINSNORT.com Management Team





More information about the Snort-users mailing list