Snort Forums Archive

Archive Home » Support » Snort will not start

Please note that the categories listed below represent an archived version of our forums pages. To view the current version and be able to post and reply to threads, please register and login here to go to the full forums pages.

[ Notice: Full Version of This Topic ]

Snort will not start

Posted by logidev on March 22, 2005 04:57:18

I recently installed snort on my hppa debian server. It was running fine, but once I rebooted I noticed it was no longer running.

I have issued the command: /usr/sbin/snort -D -d -l /var/log/snort -u snort -g snort -c /etc/snort/snort.conf

to which I receive the following in var/log/messages :
Mar 22 09:54:42 debian kernel: device eth0 entered promiscuous mode
Mar 22 09:54:42 debian kernel: device eth0 left promiscuous mode

ps aux does not show the snort daemon running.

Any ideas or suggestions would be greatly appreciated.

Note: I have tried to do dpkg-reconfigure snort which doesn't seem to help.

Posted by maverick on March 22, 2005 05:59:40

Don't run it in daemon mode (-D). Run it from the command line without that flag and you will most likely receive an error message telling you why it won't start, or continue running.

Posted by logidev on March 22, 2005 06:09:34

Thanks Maverick, seems the debian package doesn't have the mysql support built in...I had enabled output to mysql for looging and reporting to acid.

Posted by logidev on March 22, 2005 06:20:01

Please disregard this post. I guess I was half asleep when I installed snort...I didn't install the snort-mysql pkg as I should have.