1.11 Configure signal value

On some systems, signal used by snort might be used by other functions. To avoid conflicts, users can change the default signal value through ./configure options for non-Windows system.

These signals can be changed:

• SIGNAL_SNORT_RELOAD
• SIGNAL_SNORT_DUMP_STATS
• SIGNAL_SNORT_ROTATE_STATS
• SIGNAL_SNORT_READ_ATTR_TBL

Syntax:

    ./configure SIGNAL_SNORT_RELOAD=<value/name>  SIGNAL_SNORT_DUMP_STATS=<value/name>\
        SIGNAL_SNORT_READ_ATTR_TBL=<value/name> SIGNAL_SNORT_ROTATE_STATS=<value/name>

You can set those signals to user defined values or known signal names in the system. The following example changes the rotate stats signal to 31 and reload attribute table to signal SIGUSR2 :

    ./configure SIGNAL_SNORT_ROTATE_STATS=31 SIGNAL_SNORT_READ_ATTR_TBL=SIGUSR2

If the same signal is assigned more than once a warning will be logged during snort initialization. If a signal handler cannot be installed a warning will be logged and that has to be fixed, otherwise the functionality will be lost.

Signals used in snort

Signal name	Default value	Action
SIGTERM	SIGTERM	exit
SIGINT	SIGINT	exit
SIGQUIT	SIGQUIT	exit
SIGPIPE	SIGPIPE	ignore
SIGNAL_SNORT_RELOAD	SIGHUP	reload snort
SIGNAL_SNORT_DUMP_STATS	SIGUSR1	dump stats
SIGNAL_SNORT_ROTATE_STATS	SIGUSR2	rotate stats
SIGNAL_SNORT_READ_ATTR_TBL	SIGURG	reload attribute table
SIGNAL_SNORT_CHILD_READY	SIGCHLD	internal use in daemon mode