[Fwd: [Snort-users] Error: unable to open local.rules]
michaels at ...155...
Wed Jun 13 13:27:21 EDT 2001
Make sure you actually have a local.rules. If not then # out that line
in the snort.conf.
Commercial Snort Support
Silicon Defense - www.silicondefense.com
Michael Steele - Snort Support Technician
From: snort-users-admin at lists.sourceforge.net
[mailto:snort-users-admin at lists.sourceforge.net] On Behalf Of Colin Wu
Sent: Friday, June 08, 2001 10:54 AM
To: Snort Users
Subject: [Fwd: [Snort-users] Error: unable to open local.rules]
Colin Wu wrote:
> It's running on an Ultra 10, Solaris 2.7 (or maybe 8, I'm not sure at
> moment). The entire message was (after the usual time-stamp, host id,
> id stuff) "ERROR: Unable to open rules file: local.rules"
> In answer to Aaron M: It doesn't seem to complain about any of the
> and it doesn't crash everytime.
> Fyodor wrote:
> > On Fri, Jun 08, 2001 at 12:32:26PM -0400, Colin Wu wrote:
> > > I periodically HUP my snort (v1.7) to checkpoint the binary dump
> > > but occasionally snort will die with the message: " ERROR: Unable
> > > open rules file: local.rules" in syslog. At this point I have to
> > > the local.rules file and make a new copy (mv local.rules local; cp
> > > local.rules).
> > >
> > > Any ideas?
> > >
> > Hmm.. sounds strange. Which platform is that? Could you quote the
> > error message too (so we could see what errno's been set).
> > thanks
> > -F
> __ _ _ Network Analyst
> / ) // ' ) / Computing & Information Services
> / __|/ o ____ / / / . . McMaster University
> (__/ (_) \_<_/ / <_ (_(_/ (_/_ (905)525-9140 ext 24050
__ _ _ Network Analyst
/ ) // ' ) / Computing & Information Services
/ __|/ o ____ / / / . . McMaster University
(__/ (_) \_<_/ / <_ (_(_/ (_/_ (905)525-9140 ext 24050
Snort-users mailing list
Snort-users at lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
Snort-users list archive:
More information about the Snort-users