[Snort-inline-users] Re: Restarting snort_inline with SIGHUP.

[C.G.Senthilkumar. <che...@cs...>]

Hi,

Following up on my previous e-mail.

Since, SIGHUP didn't restart the snort_inline daemon cleanly, I tried
running snort_inline in foreground. I was not expecting a SIGHUP to
restart snort_inline, but was trying to debug. When I sent a SIGHUP,
I got the following error:

IpfwLoop: can't bind divert socket: Address already in use

Is that any use?

Any help would be very useful.

Thanks in advance.
Senthil.

On Mon, 23 May 2005, C.G.Senthilkumar. wrote:

>
> Hi,
> This is the command line I use to invoke snort_iniline on FreeBSD 4.10 with
> ipfw on it:
> /usr/local/bin/sudo /usr/local/bin/snort_inline -J 500 -c 
> /users/someuser/snort/snort_inline-2.3.0-RC1/etc/snort_inline.conf -D
>
> Once in a while, I update the rules files. Now, I want snort_inline to read 
> in
> the updated rules files, so I send it a SIGHUP signal using:
> sudo kill -s HUP 2381
>
> sudo tail -n 1 /var/log/message gives:
> May 23 14:14:28 node1 snort_inline: Snort initialization completed 
> successfully
> (pid=2381)
>
> However, I don't see snort_inline running after sending the SIGHUP.
>
> Is there a problem with using sudo and sending SIGHUP? What am I missing 
> here?
> Except for restarting, other things seem to work fine.
>
> Any help will be very useful.
>
> Thanks in advance.
> Senthil.
>

-- 
Today's fortune:
Learning at some schools is like drinking from a firehose.