I just installed Snort on a Fedora 24 system. The official RPMs from snort.org are made for Fedora 21 (don't know how relevant that is but mentioning it just in case). It includes a sysV init script: /etc/init.d/snortd.
Just set up the configuration and used systemctl to enable the service at boot, everything fine except that... snort starts too early. The network has not been initialized yet, so it complains that the interface is down and exits.
Code:
Oct 19 12:35:06 localhost snort[405]: FATAL ERROR: Can't start DAQ (-1) - enp2s0: That device is not up!
It only works if I start it by hand after login (sudo systemctl start snortd).
So I tried creating a directory '/etc/systemd/system/snortd.wants' and putting there a symlink to NetworkManager.service. I was hoping this would make snort start after NetworkManager does, but it didn't solve the problem. I guess sysV init scripts cannot have dependencies the way a systemd service would.
Any suggestions? Thanks.