You are not logged in.

#1 2012-02-07 21:40:51

walterjwhite
Member
Registered: 2011-05-01
Posts: 207

snort won't start

Hi all,

I had configured snort to run in the past and recently noticed snort was not starting.  The only thing that I believe I changed was I re-imaged my system, but the configuration should be where I left it.

I try to start snort from /etc/rc.d/snort start and get a fail status.  If I try to run it as a daemon from the command line, I also get nothing.

What else should I try, my log files are empty, snort does not start.


Walter

Offline

#2 2012-02-07 22:11:19

marxav
Member
From: Gatineau, PQ, Canada
Registered: 2006-09-24
Posts: 386

Re: snort won't start

walterjwhite wrote:

but the configuration should be where I left it.

You should really double check this, that is not very convincing.
Also did you really check for messages in /var/log/errors.log or /var/log/everything.log?

Offline

#3 2012-02-08 18:28:21

walterjwhite
Member
Registered: 2011-05-01
Posts: 207

Re: snort won't start

Hey thanks, it turned out my problem was 2-fold.  I keep my logs in ram and for some reason errors.log and everything.log didn't exist at that point in time.  After I restarted, I found this in errors.log:

FATAL ERROR: parser.c(5302) Could not stat dynamic module path "/usr/lib/snort_dynamicrules": No such file or directory.


I commented that from the dynamic rules and snort works again.  Is there any reason for the change in snort?  Should this work, or was this from an update?


Walter

Offline

#4 2012-02-10 01:10:07

marxav
Member
From: Gatineau, PQ, Canada
Registered: 2006-09-24
Posts: 386

Re: snort won't start

I cannot comment further really.  I began to read the book not long ago and I had the same problem.
I found this http://community.smoothwall.org/forum/v … 35#p293020

Offline

Board footer

Powered by FluxBB