|Main Archive Page > Month Archives > snort-devel archives|
Per the documentation, the --pid-path command-line argument is the directory specified.
I'll consider this issue closed.
Lee Clemens wrote:
> Hi Steve,
> The change in the syslogs after compiling with the diff was this (Mar 20)
> (surrounded by the old logs, since they were identical):
> Mar 16 13:53:30 myhost snort: WARNING: /<mypidpath>/snort_eth0.pid is
> invalid, trying /var/run...
> Mar 20 20:08:51 myhost snort: Previous Error, errno=2, (No such file or
> Mar 16 13:53:30 myhost snort: PID path stat checked out ok, PID path set to
> The pid-path I supplied to receive this error was an absolute path to a file
> which did not exist. When run with a directory, it works fine.
> Hope that helps.
> Kind Regards,
> -----Original Message-----
> From: Steven Sturges [mailto:email@example.com]
> Sent: Monday, March 17, 2008 12:38 PM
> To: Lee Clemens
> Cc: 'Snort Developers Postings'; firstname.lastname@example.org
> Subject: Re: [Snort-devel] config pidpath directive no longer valid?
> Hi Lee--
> The only two checks that are made are that the path is a
> directory and that directory is writable.
> I'm wondering if the stat() command that is used to determine
> if the path is a directory is failing (just noticed the error
> code for it is not checked).
> Per the stat() manpage, each directory in the path must have
> execute permission.
> I've attached a patch against 2.8.1 RC that prints out the error
> info that might help you diagnose the problem. Should apply to
> 2.8.0 (or easy to adapt if it does not).
> Lee Clemens wrote:
>> I have used --pid-path <mypidpath> as a command-line option, where >> <mypidpath> is a directory in which to write the pid file. >> >> However, I receive the following errors during start(): >> >> Mar 16 13:53:30 myhost snort: Initializing daemon mode >> Mar 16 13:53:30 myhost snort: Parent waiting for child... >> Mar 16 13:53:30 myhost snort: WARNING: /<mypidpath>/snort_eth0.pid is >> invalid, trying /var/run... >> Mar 16 13:53:30 myhost snort: PID path stat checked out ok, PID path set
>> /var/run/ >> Mar 16 13:53:30 myhost snort: Writing PID "4609" to file >> "/var/run//snort_eth0.pid" >> Mar 16 13:53:30 myhost snort: Signaling parent 4607 from child 4609 >> Mar 16 13:53:30 myhost snort: Daemon initialized, signaled parent pid:
>> Mar 16 13:53:30 myhost snort: Received Signal from Child >> Mar 16 13:53:30 myhost snort: Daemon parent exiting >> >> >> I have confirmed <mypidpath> is an absolute path, and root has rwx >> permission on the entire tree, so I'm not sure why snort thinks it is >> invalid. >> >> >> --Lee >> >> -----Original Message----- >> From: Steven Sturges [mailto:email@example.com] >> Sent: Monday, March 10, 2008 9:00 AM >> To: Lee Clemens >> Cc: firstname.lastname@example.org; 'Snort Developers Postings' >> Subject: Re: [Snort-devel] config pidpath directive no longer valid? >> >> Hi Lee-- >> >> The config directive pidpath has been compiled out of the code for >> some time, at least since 2.6.1. We'll try to get the docs updated >> to reflect that. >> >> However, it is supported on the commandline, you can use the >> --pid-path option and specify the path. >> >> Depending on your other options (for example, if you daemonize, >> messages go to syslog). To test a configuration without daemonization, >> use -T on the commandline. >> >> Cheers. >> -steve >> >> Lee Clemens wrote: >>> Hello all, >>> >>> I am trying to run 126.96.36.199 with the following config directive defined in >> my >>> snort.conf: >>> config pidpath: /applogs/snort/run >>> >>> But when starting Snort, I receive this in my syslogs: >>> FATAL ERROR: Unknown config directive: config pidpath: /applogs/snort/run >>> >>> No errors are printed to STDOUT. >>> >>> I checked the snort_manual (v2.7.0 comes with the VRT rules released on >>> 3-6-2008, by the way) and the config directive, pidpath, <i>is</i> >>> explicitly defined in both the 2.7.0 and 2.8.0 Snort Manuals. >>> >>> Is this a documentation error, or is 188.8.131.52 no longer recognizing
>>> pidpath"? >>> >>> I can provide any system specific information if it would be useful. >>> >>> As a side note: >>> I think it would be helpful if this fatal error was printed to >>> STDOUT, instead of a FATAL ERROR <i>only</i> being printed to syslog. >> >> >> >> ------------------------------------------------------------------------- >> This SF.net email is sponsored by: Microsoft >> Defy all challenges. Microsoft(R) Visual Studio 2008. >> http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/ >> _______________________________________________ >> Snort-devel mailing list >> Snortemail@example.com >> https://lists.sourceforge.net/lists/listinfo/snort-devel >>