Duplicate logs for snort in system.log



  • Hi there!

    For some reason, snort is logging twice on system.log, a small sample:

    Feb 21 23:16:44 firewall snort[17922]: [ Number of null byte prefixed patterns trimmed: 2181 ]
    Feb 21 23:16:44 firewall snort[17922]: [ Number of null byte prefixed patterns trimmed: 2181 ]
    Feb 21 23:16:44 firewall snort[17922]: pcap DAQ configured to passive.
    Feb 21 23:16:44 firewall snort[17922]: pcap DAQ configured to passive.
    Feb 21 23:16:44 firewall snort[17922]: Acquiring network traffic from "rl0".
    Feb 21 23:16:44 firewall snort[17922]: Acquiring network traffic from "rl0".
    Feb 21 23:16:44 firewall snort[17922]: Initializing daemon mode
    Feb 21 23:16:44 firewall snort[17922]: Initializing daemon mode
    Feb 21 23:16:44 firewall snort[22460]: Daemon initialized, signaled parent pid: 17922
    Feb 21 23:16:44 firewall snort[22460]: Daemon initialized, signaled parent pid: 17922
    Feb 21 23:16:44 firewall snort[22460]: Reload thread starting…
    Feb 21 23:16:44 firewall snort[22460]: Reload thread starting…
    Feb 21 23:16:44 firewall snort[22460]: Reload thread started, thread 0x385e5e40 (22460)
    Feb 21 23:16:44 firewall snort[22460]: Reload thread started, thread 0x385e5e40 (22460)
    Feb 21 23:16:44 firewall snort[22460]: Decoding Ethernet
    Feb 21 23:16:44 firewall snort[22460]: Decoding Ethernet

    I have "Send alerts to main System logs" disabled from the interface. Any ideas?


Log in to reply