[Snort-users] Free Inodes

Dan Mahoney, System Admin danm at ...6608...
Tue Jun 7 21:35:11 EDT 2005


I know the whole "I'm running out of inodes" thing is in the FAQ.

What I don't understand is why a potentially large directory is put in 
what is one of the typically smallest directories.

How can I change this directory?  Under FreeBSD I've tried a symlink from 
/usr/local/var/log/snort to /var/log/snort but it looks like that's blown 
away and replaced by a real directory at snort startup.

I'm less thrilled by the idea of moving all of /var/log under /usr to fix 
this.

Is there a config file I can tweak to handle this?

Also, I figure I can clean out the directory with a periodic cron tab 
(every five minutes)

find / -atime +1h -delete

Will this break things?

-Dan

--

"A single death is a tragedy.  A million deaths is a statistic."

-Josef Stalin, As quoted on the cover to Savatage's "Dead Winter Dead"

--------Dan Mahoney--------
Techie,  Sysadmin,  WebGeek
Gushi on efnet/undernet IRC
ICQ: 13735144   AIM: LarpGM
Site:  http://www.gushi.org
---------------------------





More information about the Snort-users mailing list