[Snort-users] snort error

Ed Borgoyn (eborgoyn) eborgoyn at ...589...
Thu Jan 12 12:52:23 EST 2017

Does line 326 of snort.conf look like:

decompress_swf { deflate lzma }

If so, then try removing the ‘lzma’ keyword.  If snort is not built with the LZMA libraries for LZMA SWF file decompression, then this keyword will lead to a syntax error.

Ed Borgoyn
Cisco Snort Development Team

From: Jim Campbell <jim at ...17675...>
Date: Thursday, January 12, 2017 at 12:20 PM
To: "snort-users at lists.sourceforge.net" <snort-users at lists.sourceforge.net>
Subject: Re: [Snort-users] snort error

It's telling you that line 326 of snort.conf has an error. Perhaps a mismatched or out of place '}'
On 1/12/2017 2:28 AM, Mojtaba Haghighipour wrote:
hi ... it's error when I run snort with command:
snort -c  /etc/snort/rules/etc/snort.conf

ERROR: /etc/snort/rules/etc/snort.conf(326) => Invalid keyword '}' for server configuration.

Fatal Error, Quitting..

Please help me..

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20170112/44ca1863/attachment.html>

More information about the Snort-users mailing list