Morpheus, After adding the PulledPork add-on events have stopped. I went back thru my snort conf file following the update tutorial and the only discrepancies I found had to do with the preproc_rule paths. In the update tutorial, the rules are turned on, in the PulledPork tutorial, they are turned off. Once I turned them back on, events started spooling to the unified2 file consistently. Which is the correct configuration?