[Emerging-Sigs] OT - To restart or not to restart that is the question
joel.esler at me.com
Mon Oct 18 19:54:47 EDT 2010
On Oct 18, 2010, at 5:08 PM, waldo kitty wrote:
> On 10/18/2010 15:53, Weir, Jason wrote:
>> How do you guys restart snort after a rule update?
>> Do a straight kill or a SIGHUP?
> they should basically result in the same thing... however, i have noted that
> memory consumption can and likely will increase with each SIGHUP if snort
> doesn't have to perform a complete reload anyway...
Yes, but I wouldn't characterize your installation as "typical" as evidenced by conversations that you and I have had offline. SIGHUPing Snort in my installation doesn't result in high memory utilization, nor do I have 3 copies of Snort running, (as you apparently do for some odd reason <shrug>).
Not that there is anything wrong with your installation, but I wouldn't characterize it as "typical" is my point.
I think the correct answer is, "It depends" and YMMV. Test it.
More information about the Emerging-sigs