[Snort-users] Snort Crash Error Cyrus

R Warner R.J.Warner at ...12615...
Fri Oct 29 06:29:22 EDT 2004

I am fairly new to Snort and have just got it up and running on Fedora Core 2.

Running in IDS  mode, everything is fine and it runs all day and most of the night until 04:02 every morning, when it crashes! I've upgraded the version of Snort to a more up to date release but am still having this problem, so can conclude it is something within my OS that is interfering with it. I have no other services running except SSH and HTTP and no crontabs either. It is more or less a fresh install.

This is the error i receive within the /var/messages log.

Oct 26 18:00:56 nt131 sshd(pam_unix)[1077]: session opened for user jim by (uid=500)
Oct 26 18:01:21 nt131 su(pam_unix)[1122]: session opened for user root by jim(uid=500)
Oct 26 22:18:36 nt131 sshd(pam_unix)[1681]: session opened for user root by (uid=0)
Oct 26 22:19:06 nt131 sshd(pam_unix)[1681]: session closed for user root
Oct 27 04:02:15 nt131 su(pam_unix)[2683]: session opened for user cyrus by (uid=0)
Oct 27 04:02:16 nt131 su(pam_unix)[2683]: session closed for user cyrus
Oct 27 04:02:19 nt131 kernel: device eth0 left promiscuous mode
Oct 27 04:02:19 nt131 snortd: snort shutdown succeeded
Oct 27 04:02:20 nt131 kernel: device eth0 entered promiscuous mode
Oct 27 04:02:20 nt131 snort: Initializing daemon mode
Oct 27 04:02:20 nt131 snort: PID path stat checked out ok, PID path set to /var/run/
Oct 27 04:02:20 nt131 snort: Writing PID "2731" to file "/var/run//snort_eth0.pid"

It would seem like cyrus is interefering with it in some way. Any suggestions please?


More information about the Snort-users mailing list