I setup snort on Centos server and add as a service. When I use service snortd start command, the log file is created but it is empty. If I use snort -q -l /var/log/snort command, the log file created and filled with logs. What should I do in order to use service snortd start and have the logs work?

3 Answers 3


Edit the init script and add -q -l /var/log/snort to snort. Save and restart the service.


You should modify the /etc/sysconfig/snort file as options will be read from there. LOGDIR (-l) is set to /var/log/snort by default.


According to Snort Manual v2.9.11 written under The Snort Project

To read packets & record them to disc, we need to specify a logging directory that If not specified, by default It is created with name log in current directory. If log directory is not configured in snort, It exits with an error message.

So, you need to specify the logging directory in the init script while starting the snort itself by typing in :

./snort -q -dev -l /path/to/log/file

Now save the script and restart the service.

Also, consider giving your time to this Script by markus1982. It would be really helpful.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .