[Snort-users] Snort Start up error

amani amani at ...14362...
Thu Apr 18 12:04:42 EDT 2013


I've run into this a time or two myself when I had commented out
something above, where the line before what I'd commented out wasn't
fully terminated (i.e. had a "\" at the end to indicate multi-line
config). I'd take a look at what's directly above the line for
including your classification.config (probably the IP rep
preprocessor), and see if you accidentally messed something up there.



Also, verify that this directory
exists: /usr/local/snort/rules/black_list.rules



If not, then: sudo touch /usr/local/snort/rules/black_list.rules



In /usr/local/snort/etc/snort.conf, verify that this line:



var BLACK_LIST_PATH ../rules



to



var BLACK_LIST_PATH /usr/local/snort/rules





On Thu, Apr 18, 2013, at 11:23 AM, Said Nurhussein wrote:

Hello All,
I've installed snort 2.9.4. 5 and using rules  files
snortrules-snapshot-2941.tar.gz
but when i try to start snort I get the following error.

ERROR: /etc/snort/rules/blacklist.rules(2) Unknown ClassType:
misc-activity
Fatal Error, Quitting..

How can I fix this.

Thank you.




-----------------------------------------------------------------------
-------

Precog is a next-generation analytics platform capable of advanced

analytics on semi-structured data. The platform includes APIs for
building

apps and a phenomenal toolset for data science. Developers can use

our toolset for easy data analysis & visualization. Get a free account!

[1]http://www2.precog.com/precogplatform/slashdotnewsletter

_______________________________________________

Snort-users mailing list

[2]Snort-users at lists.sourceforge.net

Go to this URL to change user options or unsubscribe:

[3]https://lists.sourceforge.net/lists/listinfo/snort-users

Snort-users list archive:

[4]http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users



Please visit [5]http://blog.snort.org to stay current on all the latest
Snort news!

References

1. http://www2.precog.com/precogplatform/slashdotnewsletter
2. mailto:Snort-users at lists.sourceforge.net
3. https://lists.sourceforge.net/lists/listinfo/snort-users
4. http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users
5. http://blog.snort.org/
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20130418/b5ab533a/attachment.html>


More information about the Snort-users mailing list