Reloading Snort Settings

Problem

You have made modifications to the rules, and you need Snort to reread them.

Solution

Like many other Unix programs, sending a SIGHUP to Snort will cause it to reread all its configuration files. You need to find out the process ID of Snort and then send it a SIGHUP using the kill command.

[root@frodo rules]# ps -ef | grep snort

root 10738 1 0 11:34 ? 00:00:00 snort -D -c

/etc/snort/snort.conf -l /var/log/snort

[root@frodo rules]# kill -1 10738

 

Discussion

If you are running Snort as a daemon as discussed in "Running Snort as a Linux Daemon," you need to start Snort with the full path to the executable so that it starts the right binary. Otherwise, someone could insert a compromised Snort binary in the local directory, which would execute instead.

You can, of course, reload all the Snort tables by killing the Snort process completely and starting it up again, although this will take much longer.

See Also

Snort Users Manual

Debugging Snort Rules