Re: Barnyard SID SIGHUP

Hi,

> >When i do a SIGHUP on barnyard will that then also ...
> 
> What behaviour are you seeing in particular?

Two things that I see when SIGHUP'ing barnyard after a signature update:

- A bunch of warnings like this 
  "barnyard: WARNING /etc/snort/classification.config(15): Duplicate 
  classification "not-suspicious"found, ignoring this line"

  Classifications still appear in barnyard's (syslog) output, from the 
  warning above I guess it would not pick up changes in 
  classification.config. [?]

- changes in gen-msg.map are not picked up at all.  I switched from 
  snort-2.2 rules to -current rules (which add generator ids 122/123 
  to gen-msg.map).  After SIGHUP, sfportscan alerts look like 
  "barnyard: [122:19:0] Snort Alert [122:19:0]".  When I stop/restart 
  barnyard I get "[122:19:0] portscan: UDP Portsweep", much better.


ciao,
chakl
-- 
Olaf Schreck    chakl@xxxxxxxxxx        syscall() Network Solutions, Berlin

By the way, you DON'T want to see what a meat layer buffer overrun
looks like....                          --Marcus Ranum


-------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now.
http://ads.osdn.com/?ad_id=6595&alloc_id=14396&op=click