My goal as I worked on this round of changes was to minimize both starts/stops of the Snort process and also cut down on needless rebuilding of the Snort.rules and flowbit-required.rules files during interface editing operations.  In this particular case with the CATEGORIES tab where the user is picking the rules to be enforced, it is important to rebuild the Snort.rules and flowbit-required.rules files.  However, there is no good reason to do that with each SAVE operation or during the UnSelect All or Select All operations.  So I added an APPLY CHANGES button that does this.

I restart Snort only if it is currently running, and I think this is necessary to keep users from "shooting themselves in the foot".  I see a fair number of what I think are novice Snort users on the forum, and I don't think they realize you must restart the interfaces each time you make any changes on the GUI tabs (for instance, things like whitelist or suppression list updates, rule changes, preprocessors changes, etc.)  Putting an APPLY CHANGES button in front of their face helps them out in my view.  The old method of starting/stopping on the main SNORT INTERFACES tab remains and works fine for the experienced users.