Make a direcory to put the old files in old-files allready exists so I used keep # mkdir /etc/snort/rules-update/keep Change to that dir # cd /etc/snort/rules-update/keep Get the old rules # wget http://www.montgomeryco.com/bfiles/snort-rules/rules.tar.gz Explode them # tar -xzvf rules.tar.gz Delete the rules that are in use. # rm -f /etc/snort/*.rules Copy the rules # cp *.rules /etc/snort Restart snort # /etc/rc.d/init.d/snortd restart Check to see that you don't have the errors # tail /var/log/messages Should see Somthing like this. Jul 13 12:40:17 high snort-mysql: All Jul 13 12:40:17 high snort-mysql: Jul 13 12:40:17 high snort-mysql: Portscan2 config: Jul 13 12:40:17 high snort-mysql: log: /var/log/snort/scan.log Jul 13 12:40:17 high snort-mysql: scanners_max: 3200 Jul 13 12:40:17 high snort-mysql: targets_max: 5000 Jul 13 12:40:17 high snort-mysql: target_limit: 5 Jul 13 12:40:17 high snort-mysql: port_limit: 20 Jul 13 12:40:17 high snort-mysql: timeout: 60 Jul 13 12:40:18 high snort-mysql: Snort initialization completed successfully, Snort running If this fixed it remove the call to update whereever it is. Mine was once a week. Otherwise it will update and ruin the rules again. # rm /etc/cron.weekly/update-snort.cron