[Snort-users] Reload Snort to use new ruleset

Gibson, Nathan J. (HSC) Nathan-Gibson at ...15095...
Tue Jul 26 16:39:43 EDT 2011


I have found this only works when running snort as root. Are you running snort as root?

From: RICHARD METZER [mailto:rlmst26 at ...14704...]
Sent: Tuesday, July 26, 2011 3:24 PM
To: snort-users at lists.sourceforge.net
Subject: [Snort-users] Reload Snort to use new ruleset

I understand the command kill -SIGHUP <pid> should reload Snort with the ability to read an updated ruleset.  However, it only seems to kill it.  I am manually adding new rules, so I would like to reload Snort to avoid any downtime monitoring.  I used the -enable-reload switch when I compiled Snort on an Ubuntu OS.  What am I missing?

Thanks in advance,
Rick







As I understand the command kill -SIGHUP <pid> should reload Snort with the ability to read an updated ruleset; however, it only seems to kill it.  I am manually adding new rules, so I would like to reload Snort to avoid any downtime monitoring.  I used the --enable-reload switch when I compiled Snort. What am I missing?

Thanks in advance!
Rick


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20110726/2a75d03d/attachment.html>


More information about the Snort-users mailing list