Snort not running
I just noticed that the Snort package is not running according to services (and I don't get alerts or anything).
I've tried removing it, and reinstalling it, but it didn't help.
I've tried chaning 'Performance' from 'ac' to 'ac-sparsebands', no change.
The system has been rebooted.
I have no idea where to search for the problem.
I could go for a complete reinstall of the system, but I have bad experiences with the backup / restore of the config…
Just found it in the system log… ddos rule created an error for port 25. So after removing that, it looks good...
Did u get more informations about which rule makes snort not run?? Cause i don't like to disable all ddos rules, i prefer to disabe just the rules that cause the block.
Thanks for any info!
I can't remember, I'll look into it, when I'm around the system again…