Re: Reload Snort to use new ruleset

[Marcos Rodriguez <marcos.e.rodriguez () gmail com>]

On Tue, Jul 26, 2011 at 4:44 PM, Castle, Shane <scastle () bouldercounty org>wrote:

> The command "kill -SIGHUP <pid>" has not worked for some time with Snort
> IIRC (nor pkill, which I had been using before) and the suggested init.d
> entry for controlling snort does not use it, either, but rather stop and
> start:
>
>    restart|reload)
>        $0 stop
>        $0 start
>
> I suspect the doc needs updating.
>
> Add in using barnyard2 and things get more interesting. Here is my current
> cron script that uses oinkmaster (no pulledpork suggestions please):
>
> #!/bin/bash
> cd /etc/snort
> /sbin/service barnyard2 stop
>
> ./oinkmaster.pl -o ./rules -b ./backup -C ./bleeding-oink.conf -C
> ./oinkmaster.conf >oink.out 2>&1
>
> ./create-sidmap.pl rules >sid-msg.map
> /sbin/service snort restart
> /sbin/service barnyard2 start
>
> --
> Shane Castle
> Data Security Mgr, Boulder County IT
> CISSP GSEC GCIH
>
> -----Original Message-----
> From: RICHARD METZER [mailto:rlmst26 () mail rmu edu]
> Sent: Tuesday, July 26, 2011 14:24
> To: snort-users () lists sourceforge net
> Subject: [Snort-users] Reload Snort to use new ruleset
>
> I understand the command kill -SIGHUP <pid> should reload Snort with the
> ability to read an updated ruleset.  However, it only seems to kill it.  I
> am manually adding new rules, so I would like to reload Snort to avoid any
> downtime monitoring.  I used the -enable-reload switch when I compiled Snort
> on an Ubuntu OS.  What am I missing?
>
>
> Thanks in advance,
>
> Rick
>
>
>
>
>
>
>
>
>
>
>
>
>
>
> As I understand the command kill -SIGHUP <pid> should reload Snort with the
> ability to read an updated ruleset; however, it only seems to kill it.  I am
> manually adding new rules, so I would like to reload Snort to avoid any
> downtime monitoring.  I used the --enable-reload switch when I compiled
> Snort. What am I missing?
>
> Thanks in advance!
> Rick


Hi Gents,

You need to make sure Snort is compiled with the --enable-reload switch in
your ./configure line.  This is to allow continued inspection when you make
changes to your active .conf file.  Hope this helps!

marcos

------------------------------------------------------------------------------
Got Input?   Slashdot Needs You.
Take our quick survey online.  Come on, we don't ask for help often.
Plus, you'll get a chance to win $100 to spend on ThinkGeek.
http://p.sf.net/sfu/slashdot-survey

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users

Please see http://www.snort.org/docs for documentation