[Snort-users] Error while starting Snort 3

Russ rucombs at cisco.com
Wed Jul 18 11:48:24 EDT 2018


The error is unrelated to the search engine.  It is coming from appid.  
Double check your appid config.  Mike may be able to give you some 
advice on that.  We'll change the output to make that more clear.

On 7/18/18 7:41 AM, Ľubomír Bielik via Snort-users wrote:
> Hi all,
>
> I am trying to install snort 3 on VM with centos 7.5 with this guide,
> however I fail to run snort against an interface like shown in the
> end.
> Guide:
> https://www.snort.org/documents/snort-3-on-centos-7
>
> While initialising search engine, i get fatal error and snort quits. I
> found nothing about this specific error.
>
> Error:
> --------------------------------------------------
> search engine
>                  instances: 791
>                   patterns: 81091
>              pattern chars: 1416781
>                 num states: 1081210
>           num match states: 81083
>               memory scale: MB
>               total memory: 28.5913
>             pattern memory: 4.44377
>          match list memory: 10.981
>          transition memory: 13.0699
> Could not read app_name. Line Snort Differs AppKey vmware-remote-auth
> -> vmware-remote-a
> --------------------------------------------------
> pcap DAQ configured to passive.
> FATAL: see prior 1 errors (0 warnings)
> Fatal Error, Quitting..
>
>
> Any help please?
> _______________________________________________
> Snort-users mailing list
> Snort-users at lists.snort.org
> Go to this URL to change user options or unsubscribe:
> https://lists.snort.org/mailman/listinfo/snort-users
>
> 	To unsubscribe, send an email to:
> 	snort-users-leave at lists.snort.org
>
> Please visit http://blog.snort.org to stay current on all the latest Snort news!
>
> Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette



More information about the Snort-users mailing list