[Snort-users] snort rules not being read
michaels at ...155...
Wed Sep 4 16:25:03 EDT 2002
This should detail any problems with Snort configuration
# snort -o -a -e -i eth0 -l /var/log/snort -c /etc/snort/snort.conf -T
Not sure about the startup as we need more info as to what you have
Michael Steele | System Engineer / Support Technician
mailto:michaels at ...155...
Silicon Defense: IDS solutions - http://www.silicondefense.com
Snort: Open Source Network IDS - http://www.snort.org
From: snort-users-admin at lists.sourceforge.net
[mailto:snort-users-admin at lists.sourceforge.net] On Behalf Of Donnie
Sent: Tuesday, September 03, 2002 7:40 PM
To: snort-users at lists.sourceforge.net
Subject: [Snort-users] snort rules not being read
I'm running RH7.3, snort-1.8.7, logging to /var/log/snort.
I have two problems: (1)When I boot Linux, snort does not start up and
cannot get snort to read in the rules even if I use the command "snort
eth0 -c /etc/snort" after booting. Below is a portion of the output of
preceeding command. Does anyone have a configuration that works??
hostname# snort -i eth0 -c /etc/snort
Log directory = /var/log/snort
Initializing Network Interface eth0
--== Initializing Snort ==--
Decoding Ethernet on interface eth0
Initializating Output Plugins!
Parsing Rules file /etc/snort
Initializing rule chains...
0 Snort rules read...
0 Option Chains linked into 0 Chain Headers
0 Dynamic rules
Rule application order: ->activation->dynamic->alert->pass->log
--== Initialization Complete ==--
-*> Snort! <*-
Version 1.8.7 (Build 128)
MSN Photos is the easiest way to share and print your photos:
This sf.net email is sponsored by: OSDN - Tired of that same old
cell phone? Get a new here for FREE!
Snort-users mailing list
Snort-users at lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
Snort-users list archive:
More information about the Snort-users