Ask Ubuntu is a question and answer site for Ubuntu users and developers. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am using Ubuntu 11.10 Gnome.

I installed an older version of Snort, uninstalled it and tried to install the latest version as root using sudo. However, the install crashed because root does not have permission to change or remove /var/log/snort. I thought root was supposed to have permission to do anything. I cannot even change or rm the directory, or its contents when I su.

ls -ld /var/log/snort


drwxr-s--- 2 snort adm 4096 2013-05-16 21:17 /var/log/snort

Can anyone suggest a resolution to this problem.

Thanks, Peter.

share|improve this question

Yes, root has rights to do anything on the system, at least if nothing important is seriously broken. To become root:

sudo su

If the given directory in not empty, a recursive remove needs to be used:

rm -r /var/log/snort

However if any of the files in that directory are open, the operation still may be refused.

To change owner, simply use:

chown root /var/log/snort

If all of this doesn't work, boot in with an Ubuntu CD/USB installer and run fsck on the filesystem. Even if it seems clean, it might be easier to remove the directory with the live system.

By the way, Ubuntu 11.10 is not supported anymore, please dist-upgrade or install a newer distribution (12.04 LTS or 13.04).

share|improve this answer
I did "sudo su" went to /var/log and did "rm -r snort". I got a bunch of error messages like "rm: cannot remove snort/tcpdump.log.1362660537': Operation not permitted". "chown root /var/log/snort" resulted in "chown: changing ownership of /var/log/snort': Operation not permitted" despite the fact I was logged in as root. Thanks, Peter. – OtagoHarbour May 20 '13 at 1:06
the files are owned by adm but "sudo su adm" results in "Unknown id: adm". – OtagoHarbour May 20 '13 at 1:11
It seems like those files are open. Are you sure that snort isn't running? Use su snort as root to try it as the owner, adm is the owner group's name. – grimpitch May 20 '13 at 1:24
I closed all of my shell terminals so there should not have been an instance of snort running. I also did "snort" when logged in as root. I had uninstalled snort so it was not able to run although the log files were there and I could not get rid of them. "ps -aux |grep snort" returned "root 13275 0.0 0.0 4212 764 pts/0 S+ 21:38 0:00 grep --color=auto snort". Thanks, Peter. – OtagoHarbour May 20 '13 at 1:39
It's not running then. Check the relevant open files with lsof | grep /var/log/snort – grimpitch May 20 '13 at 1:52

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.