FW: [Snort-users] New rule file format and lost path info

Ginnetty, James JGinnetty at ...1561...
Wed Mar 14 14:10:06 EST 2001


And while we're talking about it..... I've seen the same behavior with
processing snort rules within snortsnarf. It seems to want an explicit path
on the include statement or have everything in the default directory.

  Jim

-----Original Message-----
From: Burleson, Lee (IA) [mailto:Lee.Burleson at ...1358...]
Sent: Wednesday, March 14, 2001 1:49 PM
To: 'Steve Halligan'; Snort-Users (E-mail)
Subject: RE: [Snort-users] New rule file format and lost path info


Steve -

Since you have opened up this subject...
Even on Win2k there is that problem.

Given:
* The subfolder ...\snort\rules contains snort.conf and *.rules
* -c ...\snort\rules\snort.conf  is used at runtime

I found that the working directory must be ...\snort\rules or Snort errors
out with "ERROR: Unable to open rules file: "...

I think the default behavior should be that it looks for included rules in
the same directory that snort.conf is in.

- Lee

> -----Original Message-----
> From: Steve Halligan [mailto:agent33 at ...187...]
> Sent: Wednesday, March 14, 2001 11:11 AM
> To: Snort-Users (E-mail)
> Subject: [Snort-users] New rule file format and lost path info
> 
> 
> I start snort with the following Commandline:
> 
> #/usr/local/snort/snort -D -dev -c /usr/local/snort/snort.conf
> 
> if I am not in the /usr/local/snort dir, snort can't find the 
> included rule
> files.  If the full path to the rule files is not included in 
> the conf file,
> snort looks for the includes relative to the dir you are 
> currently in rather
> than relative to the specified location of snort.conf.  This 
> of course also
> screws up any hope of HUPing it.
> -Steve
> 
> _______________________________________________
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> http://lists.sourceforge.net/lists/listinfo/snort-users
> 

_______________________________________________
Snort-users mailing list
Snort-users at lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
http://lists.sourceforge.net/lists/listinfo/snort-users
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20010314/d28cd33c/attachment.html>


More information about the Snort-users mailing list