[Snort-users] Cross-device link ??

Andreas Östling andreaso at ...236...
Tue Jun 17 22:48:21 EDT 2003


On Tue, 17 Jun 2003, Schmehl, Paul L wrote:

> I'm running oinkmaster through cron every night, and I started getting
> this a few days back.  I thought it might be a temporary glitch, but it
> doesn't appear to be now.  Anyone have a clue what this is?  A dangling
> symlink? :-)

> Could not move /tmp/oinkmaster.54914/rules/attack-responses.rules to
> /usr/local/share/snort/attack-responses.rules: Cross-device link Exiting
> at /usr/local/bin/oinkmaster line 755.

I think the error message may be bogus.
Someone (sorry, forgot who) reported this to me a while ago and he found a
bug in move() in the File::Copy module (don't know if they have fixed it)
that caused the wrong error message being printed in some situations.
When move() can't move by doing a rename (like if it's a cross-device
link), it does a normal copy instead, but if the copy also fails,
the error message from the initial move() was instead printed.

So perhaps you have some permission problem or something.
Try editing oinkmaster line 745 and 1060 and replace "move" with "copy"
and you should hopefully get a useful error message.
(or try cvs version)

/Andreas




More information about the Snort-users mailing list