<html><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">Thanks for the reply Alberto.<div><br></div><div>Someone in the forum, mwatchinski (by the way thanks :) ), told me that I have Dynamic rules and Dynamic preprocessors in the same directory.<span class="Apple-style-span" style="color: rgb(0, 51, 102); font-family: arial; font-size: 11px; -webkit-border-horizontal-spacing: 2px; -webkit-border-vertical-spacing: 2px; "></span></div><div><br></div><div>I change the directorys rules and it works :)</div><div><br></div><div>By the way I compiled snort from the source.</div><div><br></div><div>Regards,</div><div><br></div><div>Ricardo F. Teixeira</div><div><br></div><div><span class="Apple-style-span" style="color: rgb(0, 51, 102); font-family: arial; font-size: 11px; -webkit-border-horizontal-spacing: 2px; -webkit-border-vertical-spacing: 2px; "><font class="Apple-style-span" color="#000000" face="Helvetica" size="4"><span class="Apple-style-span" style="font-size: 14px; -webkit-border-horizontal-spacing: 0px; -webkit-border-vertical-spacing: 0px;"><br></span></font></span><div><div>Em 2008/09/10, ās 20:27, Alberto Colosi/SI/RM/GSI/it escreveu:</div><br class="Apple-interchange-newline"><div><p>I'm not so sure! maybe I'm wrong but:<br> <br> ----------------------------------------------------------<br> <tt>> /usr/local/lib/snort_dynamicrule/libsf_ftptelnet_preproc.so: undefined<br> > symbol:<br> > InitializeDetection<br> > Fatal Error, Quitting..</tt><br> ----------------------------------------------------------<br> <br> should say that the file is in place but load badly "undefined symbol".<br> <br> Have you used RPM package? I ever compile my packages :D<br> (best at least for me)<br> <br> <br> <br> -------------------------------<br> Alberto Colosi<br> IBM Global Business Services<br> Sistemi Informativi S.P.A.<br> IT NetWork & Security Department<br>  *-* *-* *-*<br> SECURITY IS EVERYONE'S BUSINESS<br> <br> Member of<br> IBM Information Security WW CoP<br> <br> <br> <br> <span><graycol.gif></span>Seth <<a href="mailto:sethsec@...11827...">sethsec@...11827...</a>><br> <br> <br> <table width="100%" border="0" cellspacing="0" cellpadding="0"> <tbody><tr valign="top"><td style="background-image:url(cid:2__=4EBBFE53DFFA2C008f9e8a93df938@...14413...); background-repeat: no-repeat; " width="40%"> <ul> <ul> <ul> <ul><b><font size="2">Seth <<a href="mailto:sethsec@...11827...">sethsec@...11827...</a>></font></b><font size="2"> </font><br> <font size="2">Sent by: <a href="mailto:snort-users-bounces@lists.sourceforge.net">snort-users-bounces@lists.sourceforge.net</a></font> <p><font size="2">10/09/2008 17.34</font></p></ul> </ul> </ul> </ul> </td><td width="60%"> <table width="100%" border="0" cellspacing="0" cellpadding="0"> <tbody><tr valign="top"><td width="1%"><span><ecblank.gif></span><br> <div align="right"><font size="2">To</font></div></td><td width="100%"><span><ecblank.gif></span><br> <font size="2"><a href="mailto:snort-users@...3054...forge.net">snort-users@lists.sourceforge.net</a></font></td></tr> <tr valign="top"><td width="1%"><span><ecblank.gif></span><br> <div align="right"><font size="2">cc</font></div></td><td width="100%"><span><ecblank.gif></span><br> </td></tr> <tr valign="top"><td width="1%"><span><ecblank.gif></span><br> <div align="right"><font size="2">Subject</font></div></td><td width="100%"><span><ecblank.gif></span><br> <font size="2">Re: [Snort-users] ERROR: Failed to find InitializeDetection()</font></td></tr> </tbody></table> <table border="0" cellspacing="0" cellpadding="0"> <tbody><tr valign="top"><td width="58"><span><ecblank.gif></span></td><td width="336"><span><ecblank.gif></span></td></tr> </tbody></table> </td></tr> </tbody></table> <br> <tt>Ricardo,<br> <br> Run: find / -name libsf_ftptelnet_preproc.so and figure out where that<br> file is located.<br> <br> Your snort.conf is looking for that file here:<br> /usr/local/lib/snort_dynamicrule/libsf_ftptelnet_preproc.so and the<br> output is telling you it is having trouble finding it.<br> <br> Once you figure out where that file is located, you can either change<br> the line in snort.conf, or you can relocate the files to where<br> snort.conf thinks they should be.<br> <br> Regards,<br> <br> Seth<br> <br> <br> On Sun, Sep 7, 2008 at 8:02 PM, Ricardo F. Teixeira<br> <<a href="mailto:ricardo.teixas@...846....11827...">ricardo.teixas@...11827...</a>> wrote:<br> > Hi people,<br> ><br> > I'm having this strange error, when I try to run snort:<br> ><br> > Loading dynamic engine /usr/local/lib/snort_dynamicengine/<br> > libsf_engine.so... done<br> > Loading all dynamic detection libs from /usr/local/lib/<br> > snort_dynamicrule...<br> > Loading dynamic detection library<br> > /usr/local/lib/snort_dynamicrule/libsf_ftptelnet_preproc.so... ERROR:<br> > Failed to find<br> > InitializeDetection() function in /usr/local/lib/snort_dynamicrule/<br> > libsf_ftptelnet_preproc.so:<br> > /usr/local/lib/snort_dynamicrule/libsf_ftptelnet_preproc.so: undefined<br> > symbol:<br> > InitializeDetection<br> > Fatal Error, Quitting..<br> ><br> > Snort: Version 2.8.3 (Build 16)<br> > OS: Slackware 12.1<br> ><br> > Anybody knows what it means?<br> ><br> > Best regards,<br> ><br> > Ricardo F. Teixeira<br> ><br> ><br> > -------------------------------------------------------------------------<br> > This SF.Net email is sponsored by the Moblin Your Move Developer's challenge<br> > Build the coolest Linux based applications with Moblin SDK & win great prizes<br> > Grand prize is a trip for two to an Open Source event anywhere in the world<br> > </tt><tt><a href="http://moblin-contest.org/redirect.php?banner_id=100&url=/">http://moblin-contest.org/redirect.php?banner_id=100&url=/</a></tt><tt><br> > _______________________________________________<br> > Snort-users mailing list<br> > <a href="mailto:Snort-users@lists.sourceforge.net">Snort-users@...3471...ge.net</a><br> > Go to this URL to change user options or unsubscribe:<br> > </tt><tt><a href="https://lists.sourceforge.net/lists/listinfo/snort-users">https://lists.sourceforge.net/lists/listinfo/snort-users</a></tt><tt><br> > Snort-users list archive:<br> > </tt><tt><a href="http://www.geocrawler.com/redir-sf.php3?list=snort-users">http://www.geocrawler.com/redir-sf.php3?list=snort-users</a></tt><tt><br> ><br> <br> -------------------------------------------------------------------------<br> This SF.Net email is sponsored by the Moblin Your Move Developer's challenge<br> Build the coolest Linux based applications with Moblin SDK & win great prizes<br> Grand prize is a trip for two to an Open Source event anywhere in the world<br> </tt><tt><a href="http://moblin-contest.org/redirect.php?banner_id=100&url=/">http://moblin-contest.org/redirect.php?banner_id=100&url=/</a></tt><tt><br> _______________________________________________<br> Snort-users mailing list<br> <a href="mailto:Snort-users@...4626...ceforge.net">Snort-users@lists.sourceforge.net</a><br> Go to this URL to change user options or unsubscribe:<br> </tt><tt><a href="https://lists.sourceforge.net/lists/listinfo/snort-users">https://lists.sourceforge.net/lists/listinfo/snort-users</a></tt><tt><br> Snort-users list archive:<br> </tt><tt><a href="http://www.geocrawler.com/redir-sf.php3?list=snort-users">http://www.geocrawler.com/redir-sf.php3?list=snort-users</a></tt><tt><br> </tt><br> </p></div>-------------------------------------------------------------------------<br>This SF.Net email is sponsored by the Moblin Your Move Developer's challenge<br>Build the coolest Linux based applications with Moblin SDK & win great prizes<br>Grand prize is a trip for two to an Open Source event anywhere in the world<br><a href="http://moblin-contest.org/redirect.php?banner_id=100&url=/_______________________________________________">http://moblin-contest.org/redirect.php?banner_id=100&url=/_______________________________________________</a><br>Snort-users mailing list<br><a href="mailto:Snort-users@lists.sourceforge.net">Snort-users@lists.sourceforge.net</a><br>Go to this URL to change user options or unsubscribe:<br>https://lists.sourceforge.net/lists/listinfo/snort-users<br>Snort-users list archive:<br>http://www.geocrawler.com/redir-sf.php3?list=snort-users</div><br></div></body></html>