[Snort-users] snort dead but subsys locked

Edin Dizdarevic edin.dizdarevic at ...7509...
Tue Jul 15 09:19:08 EDT 2003


Mike McCracken/BCBS wrote:
> I am getting the following message when trying to start snortd:
> 
> "snort dead but subsys locked"
> 
> Any ideas how to fix this? I am a newbie.
> 
> Mike

Using Red Hat?

See if there is a file /var/lock/subsys/snort and remove it if there.


On shutdown RedHat will shut only those services down[1] which have a
lockfile in that directory placed. So if you install software on your
own take care[2] about the lockfile in order to get it shut on reboot or
shutdown.

One would do something like this (many abbreviations possible):

SNORT_LOCKFILE="/var/lock/subsys/snort"
SNORT_PID=$(pidof /usr/local/bin/snort)

...

start_snort ()
{

if [ ! -z "$SNORT_PID" ]
then
	echo "ERROR! Snort already runnin'!"
	exit 1
fi

if [ -z "$SNORT_PID" -a -f "$SNORT_LOCKFILE" ]
then
	echo "Snort dead but subsys locked!"
	echo "Deleting the lockfile... Hang on..."
	/bin/rm -f "$SNORT_LOCKFILE"
	# Again!
	$0 start
fi

if [ -z "$SNORT_PID" -a ! -f "$SNORT_LOCKFILE" ]
then
	echo "No Snort instances found!"
	echo "Starting Snort now..."
	/usr/local/bin/snort -c /etc/snort.conf -i eth1 -D -u snort -g snort
fi

...

}

...


Regards,

Edin


[1] Means for ex. run "service snort stop"
[2] Put a lockfile in /var/lock/subsys for ex. with touch. The lockfile must
    have the same name as that particular service startskript

-- 
Edin Dizdarevic





More information about the Snort-users mailing list