Re: snort exit

[Skip Carter <skip () taygeta com>]

> hi
> does anybody knows why snort terminates itself?
> what's happening and how I can avoid it?
>
> I need to run snort all the time.
>
> maybe somebody already wrote kind of deamon to monitor
> snort and start it again when it dies.
>
> Rgds
> Piotr
>
>
>
>
>
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users


#!/bin/sh
# check_snort   verifies that snort is still running
#               restarts it if it dies
now=`date`
host=`hostname`
if [ -f /var/run/snort_fxp1.pid ]; then
        spid=`cat /var/run/snort_fxp1.pid`
        n=`ps auxw | grep $spid | grep -v "grep $spid" | wc -l`
        if [ $n -ne "1" ]; then
            rm /var/run/snort_fxp1.pid
            /usr/local/sbin/snort.init start
            echo "snort had to be restarted(A)" | /usr/bin/logger -i -p 
daemon.notice
            echo "$host had to restart(A) snort at $now" | /usr/bin/Mail 
-s"$host Snort restarted" skip () taygeta com
        fi
else
        /usr/local/sbin/snort.init start
        echo "snort had to be restarted(B)" | /usr/bin/logger -i -p 
daemon.notice
        echo "$host had to restart(B) snort at $now" | /usr/bin/Mail -s "$host 
Snort restarted" skip () taygeta com
fi
exit 0



_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users