[Snort-users] snort dead but subsys locked error

Peter Bates peter.bates at ...15381...
Mon Sep 23 10:59:36 EDT 2013


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


Hello all

On 23/09/2013 15:52, Hanson.Webster at ...16540... wrote:
> I ran it against eth0 and it comes back OK:
> 
> Snort successfully validated the configuration!
> Snort exiting

So what does it do if you run it in the foreground?

Check for other snorts running with ps, then

snort -i eth0 -c /usr/local/snort/etc/snort.conf

If the above works and captures traffic then 
it sounds like the problem lies with your init-script.

Perhaps your init-script is setting -u/-g or some other options?

- -- 
Peter Bates
Senior Information Security Officer   Phone: +44(0)2076792049
Information Services Division	      Internal Ext: 32049
University College London
London WC1E 6BT
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.13 (MingW32)
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/

iQEcBAEBAgAGBQJSQFdYAAoJELhVoVpEMS6RJIcIALHcpWIjR+pdEBc4vb4ffC88
v0o58Jvy6isvuGwt2vchUU1ivbv6VBSIXsvOpNxPwdMt13yKAmyzNe2Yq7EWTOnU
wgRGf+WK7EYo0HBEmwhKVmeoNyB6NSDm0+SpyJVbXafVqNdXRw4yRWsjyd8y/fNw
LyERWIkXZ98i3JJ9rACoGLUMo1SVBxsazX6f1ayVr86FEGkZ5dALELWvRO+bBUth
ZzekMs7USdYXfXmTx6bQDKyxleSUf8/uoTDdLzUPiygBRbRJ9jY/7hwH9t2WK2rM
Q5X8wNmnZOlRWm3GFw+sHtY8VGnrHCoZMzHuJaZTCO9VCuNw3iEeAw+mhH9u8uU=
=m29f
-----END PGP SIGNATURE-----





More information about the Snort-users mailing list