[Snort-users] Snort dying

Zakai Kinan titanyen2000 at ...131...
Tue Feb 9 22:06:53 EST 2010


My company is using debian and we have standardized on it.  I will keep looking.

--- On Mon, 2/8/10, Jason Wallace <jason.r.wallace at ...11827...> wrote:

> From: Jason Wallace <jason.r.wallace at ...11827...>
> Subject: Re: [Snort-users] Snort dying
> To: "Snort Users" <snort-users at lists.sourceforge.net>
> Date: Monday, February 8, 2010, 7:12 AM
> I've seen this happen in 2 different
> cases...
> 
> 1) If you have a system with less than 2GB RAM try setting
> "config
> detection: search-method lowmem" in your snort.conf. If
> that solves
> the problem you can play around with the different
> detection options
> to see which one works for you.
> 
> 2) Precompiled So rules: If you are using precompiled SO
> rules try
> picking a different distro or turning them off completely
> just to see
> if that is the problem. I have seen a couple of times where
> snort
> would start fine, but then bomb out a couple of hours
> later. I started
> using SO rules for a different distro and the problem went
> away.
> 
> Wally
> 
> On Sun, Feb 7, 2010 at 5:05 PM, Zakai Kinan <titanyen2000 at ...131...>
> wrote:
> > I have had snort running for a couple of months now.
>  It is stopping from time to time and I can't figure out
> why.  It is probably due to a rule.  The log is of no
> help.  Does anyone have a way to tell which rule is causing
> the problem?
> >
> >
> > TIA,
> >
> >
> > Zak
> >
> >
> >
> >
> >
> ------------------------------------------------------------------------------
> > The Planet: dedicated and managed hosting, cloud
> storage, colocation
> > Stay online with enterprise data centers and the best
> network in the business
> > Choose flexible plans and management services without
> long-term contracts
> > Personal 24x7 support from experience hosting pros
> just a phone call away.
> > http://p.sf.net/sfu/theplanet-com
> > _______________________________________________
> > Snort-users mailing list
> > Snort-users at lists.sourceforge.net
> > Go to this URL to change user options or unsubscribe:
> > https://lists.sourceforge.net/lists/listinfo/snort-users
> > Snort-users list archive:
> > http://www.geocrawler.com/redir-sf.php3?list=snort-users
> >
> 
> ------------------------------------------------------------------------------
> The Planet: dedicated and managed hosting, cloud storage,
> colocation
> Stay online with enterprise data centers and the best
> network in the business
> Choose flexible plans and management services without
> long-term contracts
> Personal 24x7 support from experience hosting pros just a
> phone call away.
> http://p.sf.net/sfu/theplanet-com
> _______________________________________________
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users
> 







More information about the Snort-users mailing list