Home page logo
/

snort logo Snort mailing list archives

Re: Snort refuses to start/run on Ubuntu 13.04
From: Mayur Patil <ram.nath241089 () gmail com>
Date: Sat, 15 Jun 2013 08:40:41 +0530

Thanks Tony for sharing useful information for users of Ubuntu 13.04 and
Snort.

-- 
*Cheers,
Mayur*.

On Sat, Jun 15, 2013 at 7:11 AM, Tony Robinson
<deusexmachina667 () gmail com>wrote:

Nevermind, I figured it out. I *thought* I had allocated 1GB of ram to the
virtual machine I'm testing autosnort for Ubuntu 13.04 on, and found out I
had allocated only 384mb of ram. What led me to realize it was memory?

I did some googling around, and using the query "kernel:" "send sigkill
to" led me to this:
http://coltf.blogspot.com/p/android-os-processes-and-zygote.html

While yes, android is vastly different from Linux in many ways, they're
both linux. Mid way down the blog I found a print statement for a function
that seems to be doing exactly what Ubuntu was doing to my box when I
attempted to start up snort.

If the system is low on memory, find a process to kill. In this case,
snort kept using more memory than what was available when I attempted to
start it, and the system kept automatically killing it (I wonder why it
wasn't using swap space?)

Ran free -m, facepalmed, then added more RAM, problem resolved.

On Fri, Jun 14, 2013 at 8:29 PM, James Lay <jlay () slave-tothe-box net>wrote:


On Jun 14, 2013, at 5:50 PM, Tony Robinson <deusexmachina667 () gmail com>
wrote:

Hello,

Wondering if any of you experienced a problem starting up snort on
Ubuntu 13.04?

I get snort 2.9.4.6 to install and compile happily on a barebones 13.04
Server install, but the minute I go to run snort I get this on the terminal:

root () as-dev-ubuntu-13-04:~# ps -ef | grep snort
root      1691  1641  0 19:43 pts/0    00:00:00 grep --color=auto snort
root () as-dev-ubuntu-13-04:~# bash /etc/rc.local
/etc/rc.local: line 15:  1699 Killed
 /usr/local/snort/bin/snort -D -u snort -g snort -c
/usr/local/snort/etc/snort.conf -i eth1

Run it command lineā€¦first start with a test:

sudo snort -T -c /usr/local/snort/etc/snort.conf

if that's good try:

sudo /usr/local/snort/bin/snort -u snort -g snort -c
/usr/local/snort/etc/snort.conf -i eth1

Curious to see the output of the above if you can provide.

James


------------------------------------------------------------------------------
This SF.net email is sponsored by Windows:

Build for Windows Store.

http://p.sf.net/sfu/windows-dev2dev
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]
AlienVault