[Snort-users] ERROR WITH VIRUS.RULES
mkettler at ...4108...
Mon Feb 4 13:13:13 EST 2002
Ok, read closely this time.. the rules directory is not where the file you
need is located.
In addition to the rules, you need a file named "classification.config".
This file is NOT in the rules subdirectory of the snort CVS tarball. It is
in the (underline, bold, flashing red letters) *etc* directory. Grab it,
put it where your rules are, watch it work.
(note this is more or less a rehash of what Chris said, with emphasis added)
FAQ maintainer: This is getting to be a common question on the list, so how
about a snort FAQ 6.22:
Q: Why do I get "Bad Priority setting" errors when snort reads my .rules files?
Make sure you have the classification.config file installed in the same
directory as your rules files. This file is included in the snort
distribution so check your downloaded tarball for it.
I'd include comments about where the file is in the distro, but the release
1.8.2 tarball had it in the root snort directory, but the current CVS
tarballs seem to have it in the etc subdir. I've not checked the latest
release tarballs to see if the etc thing is an artifact of CVS, or if the
release format is changed.
At 05:44 PM 2/4/2002 +0100, EPenove wrote:
>i have the same pb : i download this file :
>/downloads/snortrules.tar.gz & put it in the /etc/snort/
>& now i download : /downloads/snort-daily.tar.gz et put the rules directory
>in the /etc/snort/
>but i have the same error ..... !!!!!
>On Monday 04 February 2002 17:26, Chris Grout wrote:
> > You need to copy over the new classification.config into your rules
> > directory. If you are using the 'snort-daily.tar.gz', its in the ./etc
> > directory.
> > Chris
More information about the Snort-users