[Snort-openappid] Unknown preprocessor: "appid" while installing OPENAPPID

Costas Kleopa (ckleopa) ckleopa at ...5...
Thu Feb 5 10:14:02 EST 2015

When you are compiling snort, did you make sure you run the configure command with:

./configure --enable-open-appid


On Feb 5, 2015, at 7:07 AM, Rishabh Shah <rishabh420 at ...8...<mailto:rishabh420 at ...8...>> wrote:

Hi Snort Team,

Hope you are doing well.

I am installing Snort and OpenAPPID on my UBUNTU machine(Ubuntu 14.04.1 LTS). I was following the instructions listed on this<http://blog.snort.org/2014/03/openappid-install-video.html> website. I am hitting an issue in the 5th Step- Enabling OpenAppID in Snort.
I appended preprocessor appid : app_stats_filename appstats-unified.log, app_stats_period 60, app_detector_dir /usr/local/lib/openappid in the snort.conf file and executed [snort -c /etc/snort/snort.conf -T] to check if the configuration was clean or not. I ran in to the following error message:
Reputation config:
WARNING: Can't find any whitelist/blacklist entries. Reputation Preprocessor disabled.
ERROR: /etc/snort/snort.conf(515) Unknown preprocessor: "appid".
Fatal Error, Quitting..

Some details on Snort:
   ,,_     -*> Snort! <*-
  o"  )~   Version GRE (Build 149)
   ''''    By Martin Roesch & The Snort Team: http://www.snort.org/contact#team
           Copyright (C) 2014 Cisco and/or its affiliates. All rights reserved.
           Copyright (C) 1998-2013 Sourcefire, Inc., et al.
           Using libpcap version 1.5.3
           Using PCRE version: 8.31 2012-07-06
           Using ZLIB version: 1.2.8

Can you help me to debug this issue? Many thanks in advance!!

Rishabh Shah.
Dive into the World of Parallel Programming. The Go Parallel Website,
sponsored by Intel and developed in partnership with Slashdot Media, is your
hub for all things parallel software development, from weekly thought
leadership blogs to news, videos, case studies, tutorials and more. Take a
look and join the conversation now. http://goparallel.sourceforge.net/_______________________________________________
Snort-openappid mailing list
Snort-openappid at lists.sourceforge.net<mailto:Snort-openappid at ...12...rge.net>

Please visit http://blog.snort.org to stay current on all the latest Snort news!

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-openappid/attachments/20150205/0b0ac912/attachment.html>

More information about the Snort-openappid mailing list