[Snort-users] Understanding how to debug snort.config

Russ rucombs at ...589...
Tue Dec 6 19:47:44 EST 2016


This looks like the same error others have reported recently.  If your 
lines look like the below you need to remove lzma from decompress_swf or 
install liblzma.  The error message is confusing because there is a bug 
with the error message itself.

Line 325: decompress_swf { deflate lzma } \

Line 326: decompress_pdf { deflate }



On 12/6/16 6:48 PM, wkitty42 at ...14940... wrote:
> On 12/06/2016 05:26 PM, Jared F wrote:
>> I thought the (326) meant the line the error was coming from and although
>> there is a bracket there it doesn't look wrong.  Where should I start
>> learning how to troubleshoot snort?
>
> you are correct... the error was discovered at line 326... look above it to find
> the actual error... if you post that block, we can probably point the error out
> to you real quick...
>
>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20161206/6a357da1/attachment.html>


More information about the Snort-users mailing list