[Snort-users] Broken Kill USR1 Statistics

Adam Keeton akeeton at ...1935...
Thu Aug 24 10:17:59 EDT 2006


Hi  Colin,

Looks like we're not taking the difference on subsequent USR1 signals. 
I'm about to log a bug for this  issue.  Thanks for the feedback!

Adam

>I've been trying to gather some statistics from the Snort process by
>sending the USR1 kill signal, but I'm seeing some weird behavior. This
>is Snort 2.6.0.1.
>
>First time using kill -USR1:
>Aug 24 08:51:32 Sensor snort[24795]: *** Caught Usr-Signal
>Aug 24 08:51:32 Sensor snort[24795]: Snort received 7294740 packets
>Aug 24 08:51:32 Sensor snort[24795]:     Analyzed: 5628802(77.162%)
>Aug 24 08:51:32 Sensor snort[24795]:     Dropped: 1665920(22.837%)
>Aug 24 08:51:32 Sensor snort[24795]:     Outstanding: 18(0.000%)
>
>Second time using kill -USR1:
>Aug 24 08:51:40 Sensor snort[24795]: *** Caught Usr-Signal
>Aug 24 08:51:40 Sensor snort[24795]: Snort received 200871 packets
>Aug 24 08:51:40 Sensor snort[24795]:     Analyzed: 5829688(2902.205%)
>Aug 24 08:51:40 Sensor snort[24795]:     Dropped: 0(0.000%)
>Aug 24 08:51:40 Sensor snort[24795]:     Outstanding: 4289338479(2135369.750%)
>
>Anyone else seen this?
>
>Thanks,
>Colin Grady
>
>-------------------------------------------------------------------------
>Using Tomcat but need to do more? Need to support web services, security?
>Get stuff done quickly with pre-integrated technology to make your job easier
>Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
>http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
>_______________________________________________
>Snort-users mailing list
>Snort-users at lists.sourceforge.net
>Go to this URL to change user options or unsubscribe:
>https://lists.sourceforge.net/lists/listinfo/snort-users
>Snort-users list archive:
>http://www.geocrawler.com/redir-sf.php3?list=snort-users
>
>  
>





More information about the Snort-users mailing list