[Snort-users] [Snort-sigs] typical errors when trying pulledpork

Eric G eric at ...15503...
Sat Sep 8 22:05:03 EDT 2012


On Sep 8, 2012 8:26 PM, "waldo kitty" <wkitty42 at ...14940...> wrote:
>
> On 9/7/2012 22:25, Joel Esler wrote:
> > I don't see any errors. Looks like pulledpork worked correctly.
>
> no errors?
>
> > On Sep 7, 2012, at 9:29 PM, PR<oly562 at ...11827...>  wrote:
> [chomp]
> >> Reading rules...
> >> Generating Stub Rules....
> >>     An error occurred: !! WARNING: The database output plugins are
> >> considered deprecated as
> >>
> >>     An error occurred: WARNING: ip4 normalizations disabled because not
> >> inline.

That first error is letting you know that you shouldn't be logging directly
to a database with snort... going forward, you should be using barnyard2 to
log to a db

The other "errors" really look like informational warnings... snort's
letting you know that it's not configured as an inline sensor, so it
doesn't need to do all that normalization work that it would normally do.

They're essentially benign errors, as long as you're just trying to do IDS
and you're not trying to do inline IPS...

--
Eric
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20120908/84594c8f/attachment.html>


More information about the Snort-users mailing list