[Snort-users] MYSQL 4.0 root login attempt
pauls at ...6838...
Tue Aug 16 14:48:26 EDT 2005
--On Tuesday, August 16, 2005 16:24:36 -0500 David Naylor
<DNaylor at ...13086...> wrote:
> It's running on Red Hat Linux (which I'm not real familiar with). What
> is this HUPing stuff all about?
When the syslog daemon turns over log files, it usually restarts the
process that writes to the file so it will begin writing to a new one. If
you look at man (1) kill and man (5) newsyslog.conf, you'll see what I mean.
Kill has several options it can use, including TERM, which means terminate
the process normally, KILL, which means kill the process unconditionally,
and HUP, which means "hangup" and restart. If your install of snort
created an entry in newsyslog.conf that tells syslog to turn over the snort
logfile and HUP the daemon, that would explain why this happens every night.
RedHat uses a script called logrotate to turn over log files and restart
daemons. IIRC, the scripts are in /etc/logrotate.d/ (I don't use RedHat
any more, so I'm going by memory.) If there's a script in there named
"snort", then it's probably restarting the daemon every night.
Paul Schmehl (pauls at ...6838...)
Adjunct Information Security Officer
University of Texas at Dallas
AVIEN Founding Member
More information about the Snort-users