I've done searching but haven't found anything that works for me. The last thing I tried was putting this in my /etc/rc.d directory:

/usr/sbin/snort -d -h 192.168.1.0/24

That I found in the snort manual

I have snort working, I'm able to see traffic. I setup some rules to see if it's working and I see my alerts, so everything seems to be good on that end. I just can't get snort to run as a service.

Any help is appreciated.

You could create a script containing that command and drop it in the right directory for the init system of your distribution to pick up. You could also just add the command to rc.local.

Which distribution are you running?

I am running CentOS 6.5. I did put that command in my rc.local, but it doesn't seem to be working. I ran a ps -aux, but I don't see snort listed. If I issue the command 'service snort status', it says snort is unrecognized.

The service command doesn't actually check running processes. Instead, it looks for an init script with the name of the "service" in question in the /etc/init.d directory.

Putting the snort command in rc.local will ensure that it's started when the system boots (provided the command syntax is 100% correct), and the process should be visible in the process list (ps ax) after the next reboot, but the CentOS init system still won't recognize it as a "service". (There really is no such thing as a "service" in Linux, at least not like there is in Windows; it's just a distribution-specific term for a background process started by a certain kind of init system.)

You need to create or obtain what's called a "SysV Init Script" for snort. If you installed snort from an rpm package, I would have expected the package to contain such a script. Have you tried running chkconfig --list?

Thank you for your time with this, I appreciate it.

The init thing makes sense, I should have tried snortd. I know that is in my init directory. I'll have to try that with the script I have in my rc.local. Should 'service snortd status' say that snort is running if I have it setup with the correct syntax?

'Have you tried running chkconfig --list'

I have not tried this command, but will see what it gives me.