[Snort-users] Buglet in config error handling

Jim Forster jforster at ...176...
Thu Mar 1 15:22:24 EST 2001


Hrmmm...  I found 2 problems that my local copy of Snort seems to run just
fine...?
One was the bad filetype in backdoor.rules - (fixed around 2 hours ago) -
And just now found a problem with info.rules with a missing " in a rule.
My snort (current) here didn't puke on either, ran just fine.   odd.....

Try pulling it again and see if that fixes anything.....


----- Original Message -----
From: "Jason Haar" <Jason.Haar at ...294...>
To: "Snort Users" <snort-users at lists.sourceforge.net>
Sent: Thursday, March 01, 2001 1:10 PM
Subject: [Snort-users] Buglet in config error handling


> I've just download the "new improved" snortrules.tgz and attempted to run
it
> up with Snort 1.7-CVS built yesterday. It crashed on a bad config line.
>
> I haven't tracked down the line, but the error message isn't helping me:
>
> /usr/bin/snort.cvs -u snort -g snort -e -d -A full -i eth1 -c
> /etc/snort/snort.conf -v
>
> --== Initializing Snort ==--
>
> Initializing Network Interface eth1
> WARNING: OpenPcap() device eth1 network lookup:
> eth1: no IPv4 address assigned
> Decoding Ethernet on interface eth1
> Initializing Preprocessors!
> Initializing Plug-ins!
> Initializating Output Plugins!
>
> +++++++++++++++++++++++++++++++++++++++++++++++++++
> Initializing rule chains...
> [!] ERROR: Bad value in variable definition!
> Make sure you don't have a "$" in the var name
> Fatal Error, Quiting..
>
>
> Could snort report the line on which such errors occurs? Would make
tracking
> down config errors a LOT easier.
>
> Thanks
>
> --
> Cheers
>
> Jason Haar
>
> Unix/Special Projects, Trimble NZ
> Phone: +64 3 9635 377 Fax: +64 3 9635 417
>
> _______________________________________________
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> http://lists.sourceforge.net/lists/listinfo/snort-users





More information about the Snort-users mailing list