[Snort-users] restart snort after pulledpork updates ?

Anthony Sheetz sheetzam at ...17060...
Thu Jan 22 13:17:28 EST 2015


Snort needs to be compiled with reload enabled:
http://manual.snort.org/node24.html

On Thu, Jan 22, 2015 at 9:29 AM, Eugeniu Babin <eugen.babin at ...11827...>
wrote:

> Hi Joel,
> Thank You for Your replay.
> Unfortunately snort command is not accepting --reload parameter.
> I'm using 2.9.7 version.
> And I run SNORT in daemon mode.
> If I want to check daily rules updates using pulled pork then I have to
> automate somehow the restart of SNORT process, which will became more
> complicated when I'll monitor more interfaces.
> Could You please explain what did You mean by -- reload option after
> pulled pork finished his updates.
>
> Many Thanks,
> Eugene
>
>
>>
>> It is possible to just issue Snort a --reload if no shared object rules
>> have been changed.
>>
>> --
>> Joel Esler
>> Sent from my iPhone
>>
>> > On Jan 21, 2015, at 9:56 PM, waldo kitty <wkitty42 at ...14940...>
>> wrote:
>> >
>> >> On 1/21/2015 1:20 PM, Eugeniu Babin wrote:
>> >>
>> >> Should I restart snort process always after pulledpork updated the
>> ruleset ?
>> >
>> > yes... you have to to get it to reread the new and changed rules...
>> >
>> > --
>> >  NOTE: No off-list assistance is given without prior approval.
>> >        Please *keep mailing list traffic on the list* unless
>> >        private contact is specifically requested and granted.
>> >
>> >
>> ------------------------------------------------------------------------------
>> > New Year. New Location. New Benefits. New Data Center in Ashburn, VA.
>> > GigeNET is offering a free month of service with a new server in
>> Ashburn.
>> > Choose from 2 high performing configs, both with 100TB of bandwidth.
>> > Higher redundancy.Lower latency.Increased capacity.Completely compliant.
>> > http://p.sf.net/sfu/gigenet
>> > _______________________________________________
>> > Snort-users mailing list
>> > Snort-users at lists.sourceforge.net
>> > Go to this URL to change user options or unsubscribe:
>> > https://lists.sourceforge.net/lists/listinfo/snort-users
>> > Snort-users list archive:
>> > http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users
>> >
>> > Please visit http://blog.snort.org to stay current on all the latest
>> Snort news!
>> -------------- next part --------------
>> An HTML attachment was scrubbed...
>> -------------- next part --------------
>> A non-text attachment was scrubbed...
>> Name: smime.p7s
>> Type: application/pkcs7-signature
>> Size: 2322 bytes
>> Desc: not available
>>
>> ------------------------------
>>
>>
>> ------------------------------------------------------------------------------
>> New Year. New Location. New Benefits. New Data Center in Ashburn, VA.
>> GigeNET is offering a free month of service with a new server in Ashburn.
>> Choose from 2 high performing configs, both with 100TB of bandwidth.
>> Higher redundancy.Lower latency.Increased capacity.Completely compliant.
>> http://p.sf.net/sfu/gigenet
>>
>> ------------------------------
>>
>> _______________________________________________
>> Snort-users mailing list
>> Snort-users at lists.sourceforge.net
>> https://lists.sourceforge.net/lists/listinfo/snort-users
>>
>>
>> End of Snort-users Digest, Vol 104, Issue 37
>> ********************************************
>>
>
>
>
> ------------------------------------------------------------------------------
> New Year. New Location. New Benefits. New Data Center in Ashburn, VA.
> GigeNET is offering a free month of service with a new server in Ashburn.
> Choose from 2 high performing configs, both with 100TB of bandwidth.
> Higher redundancy.Lower latency.Increased capacity.Completely compliant.
> http://p.sf.net/sfu/gigenet
> _______________________________________________
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users
>
> Please visit http://blog.snort.org to stay current on all the latest
> Snort news!
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20150122/626f39d2/attachment.html>


More information about the Snort-users mailing list