[Snort-users] new snort install, error when starting snort service

Michael Giornesto mcg12 at ...11968...
Wed Apr 18 15:49:39 EDT 2007


I have a new install that is throwing an error when trying to start the 
snort service...certainly seems to be a config error in 
/etc/snort/snort.conf...but I am unsure how to locate problem.

ERROR: ERROR /etc/snort/rules/web-misc.rules Line 452 => unable to parse 
pcre regex "fn=Eye\d{4}_\d{2}.log/Rmsi"

Line 452 in /etc/snort/rules/web-misc.rules shows...

alert tcp $EXTERNAL_NET any -> $HOME_NET 8090 (msg:"WEB-MISC TrackerCam 
ComGetLogFile.php3 log information disclosure"; 
flow:to_server,established; content:"/ComGetLogFile.php3"; alert tcp 
$EXTERNAL_NET any -> $HOME_NET 8090 (msg:"WEB-MISC TrackerCam 
ComGetLogFile.php3 log information disclosure"; 
flow:to_server,established; content:"/ComGetLogFile.php3";


running on...
FC6 2.6.20
Snort 2.6.1.4
Apache 2.2.3
Mysql 5.0.27

Any suggestions are appreciated

Thanks,
Mike
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20070418/646a47b0/attachment.html>


More information about the Snort-users mailing list