Re: Why does the Snort process stop?

["Champ Clark III [Softwink]" <champ () softwink com>]

On Tue, Jan 25, 2011 at 08:14:45AM -0600, Atkins, Dwane P wrote:
> What am I doing wrong?
> Yesterday it the Snort process lasted almost 12 hours.  Before it was almost 48.
> If there a place where I can go look at why it quit?  I saw one instance in my /var/log/messages where the interface 
> enters promiscuous mode and then leave it.
> Where do I start?  I have this on a Dell PowerEdge 2800 so it has enough processor.  What about memory requirements?  
> What is the minimum for an intensive packet sniff?
>
> Can I append a troubleshooting log to a file so I can see what is happening?
> Thank you all for your help
>
> /usr/local/snort/bin/snort -D -u snort -g snort -c /usr/local/snort/etc/snort.conf -i eth1
> # configured to bring up barnyard2 on reboot
> /usr/local/bin/barnyard2 -c /usr/local/snort/etc/barnyard2.conf -G /usr/local/snort/etc/gen-msg.map -S 
> /usr/local/snort/etc/sid-msg.map -d /var/log/snort -f snort.u2 -w /var/log/snort/barny
> ard2.waldo
> exit 0

        Open a terminal.  Run....

/usr/local/snort/bin/snort -u snort -g snort -c /usr/local/snort/etc/snort.conf -i eth1

        _NOTE_ that there is no -D option.  Snort will stay in the
foreground.   Wait for it to die.   Or:

screen /usr/local/snort/bin/snort -u snort -g snort -c /usr/local/snort/etc/snort.conf -i eth1

        Hit control-D (detach).. and go about your day...  To check on the
process (on the same machine).. do a:

screen -ls  

        It'll show screens process/ID.. Then do..

screen -r {ID of your snort screen}

        If it's still running,  hit control - D (detach).  If it's
broken,   it'll likely say what happen?  You can also turn on the Snort
debug facilitity,  but I doubt you'll need to. 




-- 
        Champ Clark III | Softwink, Inc | 800-538-9357 x 101
                     http://www.softwink.com

GPG Key ID: 58A2A58F
Key fingerprint = 7734 2A1C 007D 581E BDF7  6AD5 0F1F 655F 58A2 A58F
If it wasn't for C, we'd be using BASI, PASAL and OBOL.

Attachment: _bin
Description:

------------------------------------------------------------------------------
Special Offer-- Download ArcSight Logger for FREE (a $49 USD value)!
Finally, a world-class log management solution at an even better price-free!
Download using promo code Free_Logger_4_Dev2Dev. Offer expires 
February 28th, so secure your free ArcSight Logger TODAY! 
http://p.sf.net/sfu/arcsight-sfd2d

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users