[Snort-users] New rule file format and lost path info

Burleson, Lee (IA) Lee.Burleson at ...1358...
Wed Mar 14 13:48:58 EST 2001

Steve -

Since you have opened up this subject...
Even on Win2k there is that problem.

* The subfolder ...\snort\rules contains snort.conf and *.rules
* -c ...\snort\rules\snort.conf  is used at runtime

I found that the working directory must be ...\snort\rules or Snort errors
out with "ERROR: Unable to open rules file: "...

I think the default behavior should be that it looks for included rules in
the same directory that snort.conf is in.

- Lee

> -----Original Message-----
> From: Steve Halligan [mailto:agent33 at ...187...]
> Sent: Wednesday, March 14, 2001 11:11 AM
> To: Snort-Users (E-mail)
> Subject: [Snort-users] New rule file format and lost path info
> I start snort with the following Commandline:
> #/usr/local/snort/snort -D -dev -c /usr/local/snort/snort.conf
> if I am not in the /usr/local/snort dir, snort can't find the 
> included rule
> files.  If the full path to the rule files is not included in 
> the conf file,
> snort looks for the includes relative to the dir you are 
> currently in rather
> than relative to the specified location of snort.conf.  This 
> of course also
> screws up any hope of HUPing it.
> -Steve
> _______________________________________________
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> http://lists.sourceforge.net/lists/listinfo/snort-users

More information about the Snort-users mailing list