[Snort-users] Remember where a rule came from.

Scott A. McIntyre scott at ...1050...
Sat Mar 3 05:22:29 EST 2001


Hi,

I got this error this morning:

+++++++++++++++++++++++++++++++++++++++++++++++++++
Initializing rule chains...
ERROR Line 19 => Please place "content" rules before depth, nocase or
offset modifiers.
Fatal Error, Quiting..

Which was a bit tricky to track down with the newly split apart rule
file format (which I do prefer, actually) -- would it be possible to
either have snort remember which file had a specific rule, or, perhaps
more useful, on a fatal error present the rule which caused it to break?

Just an idea...

Scott






More information about the Snort-users mailing list