[Snort-users] Startup Problem

Michael Boman michael at ...3137...
Mon Apr 5 06:52:17 EDT 2004


On Sun, 2004-04-04 at 02:32,
eric-dated-1083277626.193075aa63e273 at ...11523... wrote:
> I'm having a startup problem here with snort..the error message I
> get is the following...
> 
>  Apr  3 12:12:16 pluto snort: FATAL ERROR:
>  /var/snort/etc/snort.conf(34) => Invalid configuration token
>  'server'.  The first configuration must start with a 'global'
>  configuration type.
> 
> This is when I try to start snort with the following syntax.
> 
>  # /var/snort/bin/snort -c /var/snort/etc/snort.conf \
>    -i em1 -Cbd -t /var/snort -l /var/snort/log/em1
> 
[snip]
> include $RULE_PATH/local.rules
> include classification.config
> include reference.config

Just for the record (solved this over IRC): rules should be included at
the end of snort.conf, *after* classification.config, reference.config
and others.

Rule of thumb: rules are to be the last thing you include in snort.conf
(unless you *really* know what you are doing)

-- 
Michael Boman
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 189 bytes
Desc: This is a digitally signed message part
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20040405/b9adb5b1/attachment.sig>


More information about the Snort-users mailing list