One of my biggest peeves about Snort and running it inline is having to restart the Snort process to load new rules. This had me worried with putting snort into production as it would make it awfully hard to tweak it while live.
Today I was browsing the Snort manual and found two short paragraph’s relating to the “–enable-reload” option. Wha? Why didn’t I find this earlier? After a quick recompile with the “–enable-reload” command. What a life saver this will be when we go live!
After using that option, you can simply issue a “kill -SIGHUP pid” to have it reload without restarting!
Check out the pg 107 of the Snort manual though, as some changes require a restart, so your not going to get off completely scott free.
