[Emerging-Sigs] OT - To restart or not to restart that is thequestion

Weir, Jason jason.weir at nhrs.org
Mon Oct 18 16:02:31 EDT 2010


I hear you on not trusting the SIGHUP - question is do you worry about
the packets you miss before snort is back up and running?

-J

>On 10/18/2010 02:53 PM, Weir, Jason wrote:
>> How do you guys restart snort after a rule update?
>> 
>> Do a straight kill or a SIGHUP?
>
>TERM, followed by SIGKILL if necessary.  I can't trust SIGHUP, I end up
with zombies or unexplainable brokenness when I try.  Last I tried was
2.8.5.3
>
>> -J
>
>- -evilghost



_____________________________________________________________________________________________

Please visit www.nhrs.org to subscribe to NHRS email announcements and updates.


More information about the Emerging-sigs mailing list