[Snort-users] SNORT + PulledPork: FATAL ERROR: ... Invalid configuration line

waldo kitty wkitty42 at ...14940...
Sat Dec 20 10:38:48 EST 2014

On 12/19/2014 10:37 PM, RŌNIN wrote:
> Dec 19 21:39:18 snortest snort[17305]: FATAL ERROR:
> /etc/snort/rules/blacklist.rules(1) Invalid configuration line:
> What's wrong here?

confusion between the two blacklist files used with snort... one is used for the 
reputation processor and the other is a normal plain text rules file... they are 
separate entities and have very different formats...

check your snort.conf for the one used in your reputation processor section and 
then the one listed in your rules section... they should have different file 
names... then check your pulledpork and ensure it is using the proper names in 
the proper sections (if there is such)...

  NOTE: No off-list assistance is given without prior approval.
        Please *keep mailing list traffic on the list* unless
        private contact is specifically requested and granted.

More information about the Snort-users mailing list