Installing Snort

53

     echo  n "Starting snort: "

        cd /var/log/snort

     daemon /usr/sbin/snort  A fast  b  l /var/log/snort \

        d  D  i $INTERFACE  c /etc/snort/snort.conf

     touch /var/lock/subsys/snort

     echo

     ;;

  stop)

     echo  n "Stopping snort: "

     killproc snort

     rm  f /var/lock/subsys/snort

     echo 

     ;;

  restart)

     $0 stop

     $0 start

     ;;

  status)

     status snort

     ;;

  *)

     echo "Usage: $0 {start|stop|restart|status}"

     exit 1

esac

exit 0

[root@conformix /root]# 

Note that the same file is used to start and stop Snort. The first character in the

name of the link file determines if Snort will be started or stopped in a particular run

level. The startup link file starts with the character S. A typical startup file is /etc/

rc3.d/S50snort which is actually linked to /etc/init.d/snortd file. Simi 

larly, a typical shutdown script file starts with the letter K. For example, you can create

/etc/rc2.d/K50snort file. The init daemon will automatically start Snort when

the system moves to run level 3 and will stop it when the system goes to run level 2.

You can start and stop Snort using the script manually as well. The following two

lines start and stop Snort respectively.

/etc/init.d/snortd start

/etc/init.d/snortd stop

Note that the script and its links in the appropriate directories may have different

names. Names for links to the script entirely depend upon at what point during the star 

tup/shutdown process you want to start and stop Snort. If you used an RPM file, these

links will be created during the installation procedure of the RPM package.