Snort3 - Log file location for multiple restarts

[Ryl]

Hello,

I've been looking into see why a snort 3 instance would restart at all the time. Where in the troubleshooting file would that be logged?

Would like to know the reason why or cause. I see multiple Snort restarts daily during operation, so it doesn't seem normal.

Thank You!

[Marvin Rhoads]

I believe when Snort crashes it creates a core file in /var/common folder on the appliance.

[Ryl]

Thanks Marvin!

Yeah been working with TAC and looking at asp drops it seems snort is busy a lot which looks like causes the restarts but still looking.