Re: FATAL ERROR: OpenLogFile:::Too many links

[Chris Green <cmg () sourcefire com>]

JP Vossen <vossenjp () netaxs com> writes:

> A colleague is getting the following error, after which Snort dies.  Google,
> this list archive, the FAQ and a quick look at the source did not help.
>
> snort: FATAL ERROR: OpenLogFile() =>mkdir(/var/log/snort/64.xxx.xxx.xxx) log
> directory: Too many links
>
> He also tells me that "/var/log/snort is chock full of subdirectories."
>
> He's running snort-2.0.0.tar.gz compiled from scratch on RedHat 9.0 with a
> pretty simple command line:
>       snort -D -i eth0 -c /%path_to_snort.conf%
>
> I can get the conf file if anyone cares.
>
> Anyone have any idea?

Default logging mode doesn't scale well. Remove the chockful of
directories and use -A fast -b :)
-- 
Chris Green <cmg () sourcefire com>
To err is human, to moo bovine.


-------------------------------------------------------
This SF.net email is sponsored by: VM Ware
With VMware you can run multiple operating systems on a single machine.
WITHOUT REBOOTING! Mix Linux / Windows / Novell virtual machines at the
same time. Free trial click here: http://www.vmware.com/wl/offer/345/0
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users