When snort fails to run the .pid file is of course created anyway. The problem I'm having is When I try to "stop" it so I can fix my config and start it again I can't. It says it's not started but when I try starting it again it says it's already started. So I delete the /var/run/snort_eth0.pid file and try again and it still says its started already.
What else is telling the init system that it's started? I can't find anything in the /etc/init.d/snort script that will point me to anything other than that pid file. Anyone have any idea? Thanks, Robert -- [EMAIL PROTECTED] mailing list
