Snort Forums Archive

Archive Home » Snort Newbies » Snort dead, but subsys locked. Please tell me the reason.

Please note that the categories listed below represent an archived version of our forums pages. To view the current version and be able to post and reply to threads, please register and login here to go to the full forums pages.

[ Notice: Full Version of This Topic ]

Snort dead, but subsys locked. Please tell me the reason.

Posted by orchis on March 09, 2005 23:25:56

Hi,all.
I have installed snort-2.2.0-1-fdr.rpm on my computer. My operating system is Readhat FC2.
And,i have installed snortsam together with it.
The first time i ran "service snortd status" after installing, it showed "...running...",but when i restart my computer, it shows "Snort dead, but subsys locked." each time i run "service snortd status" after ran "service snortd start".
I have carefully looked files /etc/snort/snort.conf
and rules files in /etc/snort/rules.
I cannot find any problem about that.
Please tell me the reason.
Any advice would be appreciated.
orchis

Posted by yzguy on March 10, 2005 04:18:04

Run a test of snort from a terminal
snort -T -c /etc/snort/snort.conf
This may tell you where it is failing

Posted by yvonne on April 17, 2005 03:10:51

please double check on whether your network card is UP

Posted by pjurkovi on September 15, 2006 01:29:50

On RedHat 9.0 snort 2.6.0-1 i get message snort dead but subsys locked.
I delete /var/lock/subsys/snort but nothing.
Then I try to delete /var/log/snort/alert and that's it.
Now everything working.

Posted by pjurkovi on September 15, 2006 01:31:41

Before starting snort try:

# snort -c /etc/snort/snort.conf

to check that everything in conf and rule files is ok.