just a bit of an update.
if i manually start snort from the command line it work fine.
ie: '/usr/local/bin/snort -R 4941 -D -q -l /var/log/snort/snort_pppoe04941 –pid-path /var/run --nolock-pidfile -G 4941 -c /usr/local/etc/snort/snort_4941_pppoe0/snort.conf -i fxp0' > /var/run/snort_pppoe04941.pid
however if i use the snort.sh, it does not startup. im certain it has to do with the "-i pppoe". I'm not the greatest sh programmer. any suggestions on how to fix the snort.sh to use the right interface name?
rc_start() {
For Each Iface
Only try to restart if snort is running on Iface
if [ ! -f /var/run/snort_pppoe04941.pid ]; then
/bin/pgrep -xf '/usr/local/bin/snort -R 4941 -D -q -l /var/log/snort/snort_pppoe04941 –pid-path /var/run --nolock-pidfile -G 4941 -c /usr/local/etc/snort/snort_4941_pppoe0/snort.conf -i pppoe' > /var/run/snort_pppoe04941.pid
fi
/bin/pgrep -nF /var/run/snort_pppoe04941.pid
if [ $? = 0 ]; then
/bin/pkill -HUP -F /var/run/snort_pppoe04941.pid -a
/usr/bin/logger -p daemon.info -i -t SnortStartup "Snort SOFT START For wan(4941_pppoe0)…"
else
Start snort and barnyard2
/bin/rm /var/run/snort_pppoe04941.pid
/usr/local/bin/snort -R 4941 -D -q -l /var/log/snort/snort_pppoe04941 --pid-path /var/run --nolock-pidfile -G 4941 -c /usr/local/etc/snort/snort_4941_pppoe0/snort.conf -i pppoe
/usr/bin/logger -p daemon.info -i -t SnortStartup "Snort START For wan(4941_pppoe0)..."
fi
sleep 2
if [ -f /var/run/barnyard2_pppoe04941.pid ]; then
/bin/pkill -F /var/run/barnyard2_pppoe04941.pid -a
/bin/rm /var/run/barnyard2_pppoe04941.pid
else
/bin/pkill -xf '/usr/local/bin/barnyard2 -r 4941 -f snort_4941_pppoe0.u2 –pid-path /var/run --nolock-pidfile -c /usr/local/etc/snort/snort_4941_pppoe0/barnyard2.conf -d /var/log/snort/snort_pppoe04941 -D -q'
fi
}
