[Oisf-users] Restart suricata in IPS mode without traffic loss

[Stefan Sabolowitsch]

Hi all,
im not a ipfilter  / iptables Guru.


how do i restart suricata without loosing good traffic, currently if i kill the process and restart i lose about 30 seconds of traffic while suricata restarts, not good on an ecommerce site.
I also would like a fail safe nfqueue bypass in case things go wrong, at the moment if snort goes down i also get locked out but its on a cron job to restart if its down for more than 1 minute.


I need some advice please (start / stop script nfqueue and suri)…..

thanks for any help.
Stefan
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openinfosecfoundation.org/pipermail/oisf-users/attachments/20130312/6bdc356b/attachment.html>