[Snort-users] FATAL ERROR: /usr/local/etc/snort.conf(45) Unknown rule type: ipvar.
wkitty42 at ...14940...
Mon Aug 15 22:42:11 EDT 2011
On 8/15/2011 22:22, Joel Esler wrote:
> Look at the top of the snort.conf file. You should see our recommended compile
FWIW: that would be the snort.conf distributed with the snort source code OR the
one included in the sourcefire rules archive... i forget where it is but i had
to go looking some time back because the snort.conf out installs were using was
a rather ancient one and (thankfully) it was not being overwritten when rules
and snort versions were updated... "thankfully" because our customizations would
have been lost and that would not have been a pretty picture with complaints
coming from several hundred thousand installs...
> Sent from my iPhone
> On Aug 15, 2011, at 21:32, alexus <alexus at ...11827... <mailto:alexus at ...11827...>>
>> Anything specific ?
>> On Aug 15, 2011 8:59 PM, "Joel Esler"
>> <<mailto:jesler at ...1935...>jesler at ...1935...
>> <mailto:jesler at ...1935...>> wrote:
>> > Sounds like you may need to take a look at our recommended compile options
>> at the top of the snort.conf in the etc/ directory.
More information about the Snort-users