Snort Active Checker

[j.smith1981]

How would someone go about creating  a Snort monitoring script. In a nutshell if snort was to fail for any reason or whatever, create a script that would try to re-enable it keep some sort of log say try 3 times then if it really won't work cancel the operation and stop.

I just wondered how would someone go about actually creating a script to do this?

[judex]

#!/bin/sh
SERVICE=snort
if P=$(/usr/bin/pgrep $SERVICE)
then
	/bin/echo "$SERVICE is running, PID is $P"
else
	/usr/local/etc/rc.d/snort.sh start
fi

Run it via cron every minute.

[eri--]

Why snort would fail?
I have plans to use snort -T to test a config before trying to restart snort but still have not gotten to finish that.

[judex]

Snort does not fail any more. I used that script during last weeks test phases where it often crashed.
Just posted it because j.smith1981 asked.

[j.smith1981]

Oh thank you ever so much for that, probably me being lazy as per usual to actually go back in and keep re-enabling it (or usually when I forget to check if its running) ;D

Thank you ever so much and I will give that a whirl!