Since then, i receive a notification that snort was restarted every ~2.5h. Also recognized that all my wireless clients loosing their connection from time to time. Just some minutes ago they where disconnected again and i had time to look into the logs:
Wireless Security:
2012:03:03-21:27:11 whity awed[29438]: [AP30 A40001E81F4F432] disconnected. Close socket and kill process.
2012:03:03-21:27:20 whity awed[4186]: [MASTER] new connection from 192.168.xx.yy:37868
2012:03:03-21:27:20 whity awed[20401]: [AP30 A40001E81F4F432] (Re-)loaded identity and/or configuration
2012:03:03-21:27:21 192.168.xx.yy kernel: [ 17.170000] device eth0 entered promiscuous mode
2012:03:03-21:27:21 192.168.xx.yy sysinit: Interface type not supported.
2012:03:03-21:27:22 192.168.xx.yy kernel: [ 17.900000] cfg80211: Calling CRDA for country: CH
2012:03:03-21:27:22 192.168.xx.yy ifup: Allowing Router Advertisements on lan (br-lan)
Few minutes later i also received the notification that snort was restarted.
So, also had a look into the IPS logs (see attachment, it's a bit longer)
Seems that snorts restarts first, and then wireless clients loosing their connection because of that.
