[Snort-users] FW: AW: Libovar Man info.

waldo kitty wkitty42 at ...14940...
Thu Apr 10 14:49:42 EDT 2014

On 4/10/2014 2:31 PM, Rameez Qureshi wrote:
> I don't think I got the second email, I got the one where you replied and
> suggested me starting from scratch

that is the one i'm speaking of... here's a manual quote of it ;)

On 4/9/2014 6:19 PM, Rameez Qureshi wrote:
 > for my snort.conf file when taking out the # out of the rule paths for rules and
 > for including individual rules it throws up and error and this led me to taking
 > out the # where snort seemed to fire correctly but did not load any rules

sorry! i hit the wrong keys with my previous reply :(

line 538 in your snort.conf doesn't contain a filename...
line 540 is missing the '/' between "rules" and "file"...
line 692 is missing the 'i' in "include"...

you have so many other items commented out that it is doubtful that you will get
it working without a lot of editing... you might want to start with a fresh
snort.conf and then make the few edits needed for your installation while
leaving everything else as is...

> which is what I have done now as ended up with the following:

yes i saw that... my first question is why is it looking in a 'src' directory? 
there should be no need to add paths to those include lines... generally 
speaking, those two files (classification.conf and reference.conf) should reside 
in the same directory as your snort.conf (/etc/)...

NOTE: No off-list assistance is given without prior approval.
       Please keep mailing list traffic on the list unless
       private contact is specifically requested and granted.

More information about the Snort-users mailing list