[Snort-users] Ref Error 1067

Michael Steele michaels at ...9077...
Fri Nov 7 18:53:15 EST 2003


It shouldn't make any difference about the rules, of course if you have an
include pointing to a non-existent .rules file Snort will fail to start at
all. As long as the includes match an existing .rules file then there should
be no problem, unless of course there is an error in one of the rules.

These are the correct settings for the rules in snort.conf for Windows.

var RULE_PATH d:\IDS\Snort\rules

include $RULE_PATH/nntp.rules

Note: I'm assuming that you meant "$rule_path\" instead of "$rule_set\"?

To check your configuration from the command prompt type:

<FULL_PATH>\snort.exe -c <FULL_PATH>\snort.conf -l <FULL_PATH>\log -ix -T

Note: I the switch '-ix' the 'x' is the interface number that can be derived
from using: '<FULL_PATH>\snort.exe -W'

Error 1067 is usually associated with a connection problem. Also be sure to
check your Event Log under Application for the reason.


-Michael Steele
 System Engineer / Security Support Technician     
 mailto:michaels at ...9077...    
 Website: http://www.winsnort.com
 Snort: Open Source Network IDS - http://www.snort.org

> -----Original Message-----
> From: snort-users-admin at lists.sourceforge.net [mailto:snort-users-
> admin at lists.sourceforge.net] On Behalf Of Bill Kaminski
> Sent: Friday, November 07, 2003 5:35 PM
> To: snort-users at lists.sourceforge.net
> Subject: [Snort-users] Ref Error 1067
> Hello snort-users,
>   If you encounter errors with this on starting the service, you need
>   to check your rules! Make sure whatever rules you are not using in
>   your .conf file are remd out in the rules file. I.E. AIM_Servers is
>   off in the .conf file make sure it is remd out in the misc.rule or
>   you will get the 1067 error. Also I did change the way the rules
>   path is at the bottom of the snort.conf file.... change from this
>   $rule_set/ to this $rule_set\   My service starts like a champ.
>   Outstanding IDS!!!!
> --
> Very Respectfully,
>  Bill
> The Bat! 2.00.6
> Windows XP Pro
> -------------------------------------------------------
> This SF.Net email sponsored by: ApacheCon 2003,
> 16-19 November in Las Vegas. Learn firsthand the latest
> developments in Apache, PHP, Perl, XML, Java, MySQL,
> WebDAV, and more! http://www.apachecon.com/
> _______________________________________________
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users

More information about the Snort-users mailing list