Snort won't start (stays disabled) (solved)
-
Today for some reason snort won't start. When trying to start, it still shows disabled when the Services page refreshes.
I also can't seem to locate a service log on the system for snort … how can I go about troubleshooting? Even a pointer on where in the filesystem the log is that shows the snort start/stop messaging would be helpful...
Edit: using 2.1-RELEASE (i386)
-
Today for some reason snort won't start. When trying to start, it still shows disabled when the Services page refreshes.
I also can't seem to locate a service log on the system for snort … how can I go about troubleshooting? Even a pointer on where in the filesystem the log is that shows the snort start/stop messaging would be helpful...
Edit: using 2.1-RELEASE (i386)
There was a problem last night and earlier today with the Emerging Threats emerging-bottcc.rules file. It contained some syntax errors. So if your choice of rule sets included this particular file, you would have gotten bad version of it. The problem has been fixed as of Wednesday evening.
You can tell if this was your problem by looking at the system log file for any Snort-related messages. Looking at the system log should tell you what is wrong.
Bill
-
That was it! Thank you a bunch!
