[Snort-users] snort dead but subsys locked
edin.dizdarevic at ...7509...
Tue Jul 15 09:19:08 EDT 2003
Mike McCracken/BCBS wrote:
> I am getting the following message when trying to start snortd:
> "snort dead but subsys locked"
> Any ideas how to fix this? I am a newbie.
Using Red Hat?
See if there is a file /var/lock/subsys/snort and remove it if there.
On shutdown RedHat will shut only those services down which have a
lockfile in that directory placed. So if you install software on your
own take care about the lockfile in order to get it shut on reboot or
One would do something like this (many abbreviations possible):
if [ ! -z "$SNORT_PID" ]
echo "ERROR! Snort already runnin'!"
if [ -z "$SNORT_PID" -a -f "$SNORT_LOCKFILE" ]
echo "Snort dead but subsys locked!"
echo "Deleting the lockfile... Hang on..."
/bin/rm -f "$SNORT_LOCKFILE"
if [ -z "$SNORT_PID" -a ! -f "$SNORT_LOCKFILE" ]
echo "No Snort instances found!"
echo "Starting Snort now..."
/usr/local/bin/snort -c /etc/snort.conf -i eth1 -D -u snort -g snort
 Means for ex. run "service snort stop"
 Put a lockfile in /var/lock/subsys for ex. with touch. The lockfile must
have the same name as that particular service startskript
More information about the Snort-users