Hi,
I have opensuse 11.2 and installed snort 2.8.5.3-1.1 from the monitor SW repository.
Everything looks fine so far beside a little issue I can not resolve:
starting snort with the /etc/init.d/snortd script produces always under /var/run the file snort_eth0.pid and snort_eth0.pid.lck.
Even though I have configured /etc/sysconfig/snort to use either
INTERFACE=eth1
or
INTERFACE=“eth0 eth1”
After some debugging I have the feeling that /sbin/startproc is playing some tricks on me but I don’t have clue how it generates the “eth0” part of the filename.
Any idea?
kind regards,
Alexander De Bernardi