[Snort-users] Dynamic Rule [X:XXXXX] was not initialized properly.

waldo kitty wkitty42 at ...14940...
Fri Jun 13 15:06:25 EDT 2014


On 6/13/2014 11:18 AM, Jeff Meigs wrote:
> Here is some more info though. The Error only occurs at a specific time.
> Presumably the time the rules are downloaded. It will throw the error like 50+
> times  for 3 specific rules(3:29908, 3:16533, 3:8351). I’ve even tried
> suppressing these rules to no avail. These errors are all created at the same
> point in time.  This just started happening about a week ago. We have made no
> adjustments to any file.

this almost sounds like a race condition...

1. what tool are you using to download your rules updates?

2. is this tool processing the download in a separate area and
    then copying the rules to the operational area?

3. does the tool's log file show it is processing during this error period?

4. snort is being restarted after the rules have been updated, right?

-- 
  NOTE: No off-list assistance is given without prior approval.
        Please *keep mailing list traffic on the list* unless
        private contact is specifically requested and granted.




More information about the Snort-users mailing list