# Problems stopping snort with start-stop-daemon

## volumen1

I have about 50 servers running snort.  I'm trying to manage them through puppet and I'm having problems with puppet restarting snort after configuration changes.  So, I did some investigation and it looks like the real problem is that the snort initscript is having problems stopping snort.  Here's a case in point.

```
server ~ # /etc/init.d/snort start

 * Starting snort ...                                                                                         [ ok ]

server ~ # ps aux | grep snort

snort     4633  0.0  3.1  81444 32308 ?        Ssl  20:50   0:00 /usr/bin/snort --nolock-pidfile --pid-path /var/run/snort -D -u snort -i eth0 -c /etc/snort/snort.conf

root      4643  0.0  0.0   1924   596 pts/0    S+   20:50   0:00 grep --colour=auto snort

server ~ # cat /var/run/snort/snort_eth0.pid 

4633

server ~ # /etc/init.d/snort stop

 * Stopping snort ...                                                                                         [ ok ]

server ~ # ps aux | grep snort

snort     4633  0.0  3.1  81444 32312 ?        Ssl  20:50   0:00 /usr/bin/snort --nolock-pidfile --pid-path /var/run/snort -D -u snort -i eth0 -c /etc/snort/snort.conf

root      4735  0.0  0.0   1924   596 pts/0    S+   20:51   0:00 grep --colour=auto snort

server ~ # cat /var/run/snort/snort_eth0.pid 

4633

server ~ # /etc/init.d/snort start

 * Starting snort ...                                                                                         [ !! ]

server ~ # /etc/init.d/snort zap  

 * Manually resetting snort to stopped state.

server ~ # killall -9 snort

server ~ # /etc/init.d/snort start

 * Starting snort ...                                                                                         [ ok ]

server ~ # 
```

What's even more frustrating is that it works on some of the servers.  Why that is frustrating is because these ~50 machines are built from a single VMware server image with only IP and other changes made.  So, they are all identical.

Anyway,  I'm hoping someone has seen this before?

----------

## volumen1

I think I've solved this now.  I modified the initscript to do "ifconfig eth0 down" before it tries to stop snort and that seems to fix it.  Not exactly sure why, though.

----------

