2008/1/28, Javier Fernández-Sanguino Peña <[EMAIL PROTECTED]>: > On Thu, Jan 24, 2008 at 08:21:49PM +0100, Johan Walles wrote: > > On system shutdown I get this from Snort: > > Jan 21 08:29:21 foo snort[8266]: Snort exiting > > Jan 21 08:29:21 foo snort[8266]: Could not remove pid file > > /var/run//snort_eth0.pid: Permission denied > > What filesystem are you using for /var/run?
ext3: [EMAIL PROTECTED]:~$ df -h /var/run/ Filsystem Storlek Anvnt Tillg Anv% Monterat på /dev/sda2 58G 47G 8,3G 85% / [EMAIL PROTECTED]:~$ mount |grep /dev/sda2 /dev/sda2 on / type ext3 (rw,errors=remount-ro) > Do you get the same error if you > manually stop snort (i.e. not on system shutdown). Yes I do. I just did sudo /etc/init.d/snort stop, and this is the very last thing snort says before terminating, right after the "Snort exiting" message. > This message is quite > strange since root runs the stop script. That "permission denied" message > does not make much sense. I just looked for the PID file complained about in the error message, and after I shut down Snort it's not there (in spite of the error message). The only thing that's still there is a snort_eth0.pid.lck. If I start Snort again, it says in the log "Writing PID "5366" to file "/var/run//snort_eth0.pid"", and the PID file appears. Cheers //Johan
