[Snort-users] [Spam] Reload Snort to use new ruleset

Lay, James james.lay at ...15009...
Tue Jul 26 16:40:35 EDT 2011


What does your syslog say?  Mine says the below when sighupping it:

 

Jul 26 14:07:37 goids snort[9188]:         --== Reloading Snort ==--

Jul 26 14:08:38 goids snort[9188]: Reload thread starting...

 

Also, try running snort in the foreground (no--D) fire off the sudo kill
-SIGHUP <pid> in a different terminal, and see what happens.  Lastly get
to the snort source and head config.log to verify that it was indeed
configured with --reload

 

James 

 

From: RICHARD METZER [mailto:rlmst26 at ...14704...] 
Sent: Tuesday, July 26, 2011 2:24 PM
To: snort-users at lists.sourceforge.net
Subject: [Spam] [Snort-users] Reload Snort to use new ruleset
Importance: Low

 

I understand the command kill -SIGHUP <pid> should reload Snort with the
ability to read an updated ruleset.  However, it only seems to kill it.
I am manually adding new rules, so I would like to reload Snort to avoid
any downtime monitoring.  I used the -enable-reload switch when I
compiled Snort on an Ubuntu OS.  What am I missing?

 

Thanks in advance,

Rick

 

 

 

 

 

 

 

As I understand the command kill -SIGHUP <pid> should reload Snort with
the ability to read an updated ruleset; however, it only seems to kill
it.  I am manually adding new rules, so I would like to reload Snort to
avoid any downtime monitoring.  I used the --enable-reload switch when I
compiled Snort. What am I missing?

 

Thanks in advance!

Rick

 

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20110726/ab94a4d7/attachment.html>


More information about the Snort-users mailing list