[Snort-devel] Solaris 8 crash

Steven Rudolph srudolph at ...1213...
Wed Apr 9 13:16:07 EDT 2003


I have looked in the BUGS file and the issue seems to be the lack of a
core file.
That is why I set this: export SNORT_DEBUG=4294967295 and ran snort.
Ok, I feel silly here but could you help me out on this?
Below is a portion of my earlier post:

I am attempting to run Snort 2.0rc4:
Ultra 5 SPARC
Solaris 8
Configure: ./configure --with-mysql=/usr/local/mysql
--with-libpcap-libraries=/usr/src/libpcap-0.7.1
--with-libpacp-includes=/usr/src/libpcap-0.7.1

Pre-processors:
Frag2
stream4: detect_scans, disable_evasion_alerts
stream4_reassemble
http_decode: 80 unicode iis_alt_unicode double_encode iis_flip_slash
full_whitespace
rpc_decode: 111 32771
bo
telnet_decode
conversation: allowed_ip_protocols all, timeout 60, max_conversations
3000
portscan2: scanners_max 256, targets_max 1024, target_limit 5,
port_limit 20, timeout 60

Rules:
Using the rule set that came with 2.0rc4.

Output plugins:
output database: alert, mysql, user=snort password=snort dbname=snort
host=xxx.yyy.zzz.aaa

Startup:
/usr/local/bin/snort -o -i qfe0 -l /var/log/snort -g snort -u snort -m
007 -c /etc/snort/snort.conf -z -D

There is no snort error or core files.


Thanks for all your assistance!!!
Steve


-----Original Message-----
From: Chris Green [mailto:cmg at ...402...] 
Sent: Wednesday, April 09, 2003 4:01 PM
To: Steven Rudolph
Cc: snort-devel at lists.sourceforge.net
Subject: Re: [Snort-devel] Solaris 8 crash


"Steven Rudolph" <srudolph at ...1213...> writes:

> I got the debug working.
>
> I have the full debug turned on and it seems to crash faster (minutes)

> when this is on.

Please follow the BUGS file for creating a backtrace :)

It appears you have set SNORT_DEBUG.  Unless you are looking for
something specific, that output can produce a lot of stuff that won't
help. 
-- 
Chris Green <cmg at ...402...>
Don't use a big word where a diminutive one will suffice.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 3213 bytes
Desc: not available
URL: <https://lists.snort.org/pipermail/snort-devel/attachments/20030409/31748c01/attachment.bin>


More information about the Snort-devel mailing list