AW: [Snort-users] reg Snort IDMEF plugin problem, NULL facility

Mayank Bhatnagar mayank at ...9923...
Wed Mar 30 03:36:12 EST 2005


Hello Poppi,

Thanks a lot for the changes with the keyword facility_default. I could 
not find it anywhere in README.idmef (which is the only document 
available). 

Great to know that you are going to provide the documentation along with 
the laetst draft.

I also wanted to submit the problems I faced while installing the plugin.

The install-idmef-plugin.sh didnt work for these patches, 

	1) src_plugbase.c.diff (1 out of 3 hunk failed)
	2) src_plugin_enum.h.diff ( 1 hunk failed)

Details below:
---------------
patching file configure.in
Hunk #1 succeeded at 802 (offset 111 lines).
patching file plugbase.c
Hunk #1 FAILED at 103.
Hunk #2 succeeded at 163 (offset 11 lines).
Hunk #3 succeeded at 568 with fuzz 1 (offset -2 lines).
1 out of 3 hunks FAILED -- saving rejects to file plugbase.c.rej
patching file plugin_enum.h
Hunk #1 FAILED at 33.
1 out of 1 hunk FAILED -- saving rejects to file plugin_enum.h.rej
patching file Makefile.am
Snort-IDMEF Plugin succesfully included! Have fun!


So I had to make the changes after seeing the .rej file. Are you aware of 
the problem and why it says being rejected?

Thanks once again,
Regards,
Mayank Bhatnagar
mayank at ...9923...

68 Electronics City ,
CDAC (Formerly NCST), 
Bangalore-560100.
Ph: 080-28523300/28520259-1200
Fax: 080-28520239
__________________________________________________________________


On Wed, 30 Mar 2005, Poppi, Sandro wrote:

> Mayang,
> 
> Please try this in snort.conf:
> 
> output idmef: 172.16.5.0/24 output=log
> facility_default=file|/var/log/snort/idmef_alerts.log analyzerid=IDS1
> dtd=/data/EIDS/CodeTrials/EC/Tools/snort-idmef/idmef-message.dtd
> 
> The logto option is deprecated, but I've not yet updated the documentation,
> sorry ;)
> 
> I'm currently working on a complete rewritten version of snort-idmef which
> also includes lot's of additional information generated in the IDMEF
> message, and it will reflect the current IDMEF draft 14.
> 
> I'll also update the documentation to reflect the new settings.
> 
> Best regards,
> Sandro
> -----Urspr�ngliche Nachricht-----
> Von: snort-users-admin at lists.sourceforge.net
> [mailto:snort-users-admin at lists.sourceforge.net] Im Auftrag von Mayank
> Bhatnagar
> Gesendet: Mittwoch, 30. M�rz 2005 12:00
> An: snort-users at lists.sourceforge.net
> Betreff: [Snort-users] reg Snort IDMEF plugin problem, NULL facility
> 
> 
> hi Snort Users,
> 
> I have installed Snort IDMEF plugin. There were some initial problems with 
> patching but that were sorted by manually patching the file. I didnt get 
> further problems in configure and make, make install. Then I enabled IDMEF 
> plugin in configuration in snort.conf, with the following minimum but MUST 
> arguments, 
> 
> -----------------------------------------------------------
> output idmef: 172.16.5.0/24 output=log logto=/var/log/snort/idmef_alerts.log
> analyzerid=IDS1
> dtd=/data/EIDS/CodeTrials/EC/Tools/snort-idmef/idmef-message.dtd
> -----------------------------------------------------------
> 
> and ran snort for some time in default alert mode with -dev options, 
> 
> I am getting the following error
> 
> -----------------------------------------------------------
> ERROR: IDMEF: cannot output messages on a NULL facility
> -----------------------------------------------------------
> 
> I referred for this error in Snort Users archive and found a similar 
> posting,
> 
> 	http://archives.neohapsis.com/archives/snort/2003-09/0565.html
> 
> The error refers to the same NULL facility, but there has been no 
> answers/reply.
> 
> Please suggest what could be problem. I am sure there is some 
> configuration problem with respect to the output idmef: plugin. But since 
> Snort initially says 
> 
> -----------------------------------------------------------
> IDMEF: No stored alert id.  Continuing with alert id = 1
> Snort IDMEF Plugin successfully initialized
> -----------------------------------------------------------
> 
> it is sugesting IDMEF has been properly initialised.
> 
> 
> My OS: Fedora Core release 2 (Tettnang)
> Snort version: snort-2.3.0
> snort-idmef version: snort-idmef-plugin-1.2.1alpha2.0.5
> Libidmef: libidmef-0.7.3-beta (source bz2)
> 
> 
> Thanks & Regards,
> Mayank Bhatnagar
> mayank at ...9923...
> 
> 68 Electronics City ,
> CDAC (Formerly NCST), 
> Bangalore-560100.
> Ph: 080-28523300/28520259-1200
> Fax: 080-28520239
> __________________________________________________________________
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> -------------------------------------------------------
> SF email is sponsored by - The IT Product Guide
> Read honest & candid reviews on hundreds of IT Products from real users.
> Discover which products truly live up to the hype. Start reading now.
> http://ads.osdn.com/?ad_id=6595&alloc_id=14396&op=click
> _______________________________________________
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users
> 
> 
> -------------------------------------------------------
> SF email is sponsored by - The IT Product Guide
> Read honest & candid reviews on hundreds of IT Products from real users.
> Discover which products truly live up to the hype. Start reading now.
> http://ads.osdn.com/?ad_ide95&alloc_id396&op�k
> _______________________________________________
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list
> 






More information about the Snort-users mailing list