[Snort-users] snort rules not being read

Donnie Green d_greenjr at ...125...
Tue Sep 3 19:41:03 EDT 2002


I'm running RH7.3, snort-1.8.7, logging to /var/log/snort.

I have two problems: (1)When I boot Linux, snort does not start up and (2) I
cannot get snort to read in the rules even if I use the command "snort -i
eth0 -c /etc/snort" after booting.  Below is a portion of the output of
preceeding command.  Does anyone have a configuration that works??


hostname#  snort -i eth0 -c /etc/snort
Log directory = /var/log/snort

Initializing Network Interface eth0

        --== Initializing Snort ==--
Decoding Ethernet on interface eth0
Initializing Preprocessors!
Initializing Plug-ins!
Initializating Output Plugins!
Parsing Rules file /etc/snort

+++++++++++++++++++++++++++++++++++++++++++++++++++
Initializing rule chains...
0 Snort rules read...
0 Option Chains linked into 0 Chain Headers
0 Dynamic rules
+++++++++++++++++++++++++++++++++++++++++++++++++++

Rule application order: ->activation->dynamic->alert->pass->log

        --== Initialization Complete ==--

-*> Snort! <*-
Version 1.8.7 (Build 128)

_________________________________________________________________
MSN Photos is the easiest way to share and print your photos: 
http://photos.msn.com/support/worldwide.aspx





More information about the Snort-users mailing list