# Snort Setup and Config

## scooter

anyone familiar with SNORT?

I got it installed and what not, edited the /etc/snort/snort.conf file and the /etc/conf.d/snort file to the proper settings

but when i try and start snort it acts like its starts and creates the pid file in /var/run but i can't grep on it to verify

and if i try and stop it via /etc/init.d/snort stop it doesn't work either

any help would be appreciated.

----------

## elcesar

 *scooter wrote:*   

> anyone familiar with SNORT?
> 
> I got it installed and what not, edited the /etc/snort/snort.conf file and the /etc/conf.d/snort file to the proper settings
> 
> but when i try and start snort it acts like its starts and creates the pid file in /var/run but i can't grep on it to verify
> ...

 

 You need to put something like this in your /etc/rc.conf

export SNORT_OPTS="-D -c /etc/snort/snort.conf"

(-D Daemon mode, -c config file)

----------

## Styles

I'm running Demarc just because the web interface is pretty and I can see at a glance all the boxes that have using a snort sensor. If you setup Demarc dont install the apache and mysql that it wants to install just emerge apache and mysql as normal. I also have snarf running as well which makes it easy to fire off e-mails to the script kiddies isp etc...

----------

## Xor

acid is not so pretty... but free.... and you are free to make a theme for it  :Smile: 

but to get back to the topic... what does "snort -T" say?

----------

## Nitro

 *elcesar wrote:*   

>  You need to put something like this in your /etc/rc.conf
> 
> export SNORT_OPTS="-D -c /etc/snort/snort.conf"
> 
> 

 

Do not do this.  The SNORT_OPTS variable is inherited from /etc/conf.d/snort.  Edit it there.  

 *Xor wrote:*   

> but to get back to the topic... what does "snort -T" say?

 

Add a -c argument to that so we use the same config file: 

```
snort -T -c /etc/snort/snort.conf
```

----------

## elcesar

 *Nitro wrote:*   

>  *elcesar wrote:*    You need to put something like this in your /etc/rc.conf
> 
> export SNORT_OPTS="-D -c /etc/snort/snort.conf"
> 
>  
> ...

 [/quote]

 Ok. That was only the easiest way to do that. and it works..

Thanks for your help

----------

