Re: snort dead but subsys locked

[Edin Dizdarevic <edin.dizdarevic () interActive-Systems de>]

Mike McCracken/BCBS wrote:
> I am getting the following message when trying to start snortd:
>
> "snort dead but subsys locked"
>
> Any ideas how to fix this? I am a newbie.
>
> Mike

Using Red Hat?

See if there is a file /var/lock/subsys/snort and remove it if there.


On shutdown RedHat will shut only those services down[1] which have a
lockfile in that directory placed. So if you install software on your
own take care[2] about the lockfile in order to get it shut on reboot or
shutdown.

One would do something like this (many abbreviations possible):

SNORT_LOCKFILE="/var/lock/subsys/snort"
SNORT_PID=$(pidof /usr/local/bin/snort)

...

start_snort ()
{

if [ ! -z "$SNORT_PID" ]
then
        echo "ERROR! Snort already runnin'!"
        exit 1
fi

if [ -z "$SNORT_PID" -a -f "$SNORT_LOCKFILE" ]
then
        echo "Snort dead but subsys locked!"
        echo "Deleting the lockfile... Hang on..."
        /bin/rm -f "$SNORT_LOCKFILE"
        # Again!
        $0 start
fi

if [ -z "$SNORT_PID" -a ! -f "$SNORT_LOCKFILE" ]
then
        echo "No Snort instances found!"
        echo "Starting Snort now..."
        /usr/local/bin/snort -c /etc/snort.conf -i eth1 -D -u snort -g snort
fi

...

}

...


Regards,

Edin


[1] Means for ex. run "service snort stop"
[2] Put a lockfile in /var/lock/subsys for ex. with touch. The lockfile must
    have the same name as that particular service startskript

-- 
Edin Dizdarevic



-------------------------------------------------------
This SF.Net email sponsored by: Parasoft
Error proof Web apps, automate testing & more.
Download & eval WebKing and get a free book.
www.parasoft.com/bulletproofapps1
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users