[Emerging-Sigs] OT - To restart or not to restart that is the question

Joel Esler joel.esler at me.com
Mon Oct 18 19:54:47 EDT 2010

On Oct 18, 2010, at 5:08 PM, waldo kitty wrote:
> On 10/18/2010 15:53, Weir, Jason wrote:
>> How do you guys restart snort after a rule update?
>> Do a straight kill or a SIGHUP?
> they should basically result in the same thing... however, i have noted that 
> memory consumption can and likely will increase with each SIGHUP if snort 
> doesn't have to perform a complete reload anyway...

Waldo --

Yes, but I wouldn't characterize your installation as "typical" as evidenced by conversations that you and I have had offline.  SIGHUPing Snort in my installation doesn't result in high memory utilization, nor do I have 3 copies of Snort running, (as you apparently do for some odd reason <shrug>).  

Not that there is anything wrong with your installation, but I wouldn't characterize it as "typical" is my point.

I think the correct answer is, "It depends" and YMMV.  Test it.  

Joel Esler

More information about the Emerging-sigs mailing list