<p dir="ltr">As Snort releases new versions, older signature sets are no longer available.</p>
<p dir="ltr">We also need more information to help with your issue. Pulledpork looked like it ran successfully.</p>
<div class="gmail_quote">On May 29, 2015 9:23 AM, "Robert Lasota" <<a href="mailto:wrkilu@...3879...">wrkilu@...3879...</a>> wrote:<br type="attribution"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<p>Dnia Piątek, 29 Maja 2015 09:50 Robert Lasota <<a href="mailto:wrkilu@...3879..." target="_blank">wrkilu@...3879...</a>> napisał(a)</p>
<blockquote>
<p>Hi,<br><br><br>Did somebody meet with such strange case ? I mean, I had working Pulledpork, then I changed someting (but even I don't know what because I turned out later about that), and now duting run it doesn't display what it update/change in rules and laso it start diplicate rules! After every next run I get in rules directory thse same files with rules but with added the same rules as later :(</p>
<p> </p>
<p>./<a href="http://pulledpork.pl" target="_blank">pulledpork.pl</a> -P -k -I security -c etc/pulledpork.conf<br><br>    <a href="http://code.google.com/p/pulledpork/" target="_blank">http://code.google.com/p/pulledpork/</a><br>      _____ ____<br>     `----,\    )<br>      `--==\\  /    PulledPork v0.7.0 - Swine Flu!<br>       `--==\\/<br>     .-~~~~-.Y|\\_  Copyright (C) 2009-2013 JJ Cummings<br>  
@_/        /  66\_  <a href="mailto:cummingsj@...11827..." target="_blank">cummingsj@...11827...</a><br>    |    \   \   _(")<br>     \   /-| ||'--'  Rules give me wings!<br>      \_\  \_\\<br> ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~<br><br>Checking latest MD5 for snortrules-snapshot-2962.tar.gz....<br>        They 
Match<br>        Done!<br>Prepping rules from snortrules-snapshot-2962.tar.gz for work....<br>        Done!<br>Reading rules...<br>Reading rules...<br>Activating security rulesets....<br>        Done<br>Modifying Sids....<br>        Done!<br>Processing /tmp/pulledpork-0.7.0/etc/enablesid.conf....<br>        Modified 0 rules<br>        Done<br>Processing /tmp/pulledpork-0.7.0/etc/dropsid.conf....<br>        Modified 0 rules<br>        Done<br>Processing /tmp/pulledpork-0.7.0/etc/disablesid.conf....<br>        Modified 0 rules<br>        Done<br>Setting Flowbit 
State....<br>        Enabled 777 flowbits<br>        Enabled 25 flowbits<br>        Enabled 4 flowbits<br>        Enabled 2 flowbits<br>        Done<br>Writing rules to unique destination files....<br>        Writing rules to /tmp/rules/<br>        Done<br>Generating sid-msg.map....<br>        Done<br>Writing v1 /tmp/sid-msg.map....<br>        Done<br>Fly Piggy Fly!<br>[root@...17180... pulledpork-0.7.0]</p>
<p> </p>
<p>What is going on ?</p>
<p>Robert</p>
<p> </p>
</blockquote>
<p><br><br></p>
<p>I noticed also, it doesn't actualize (during working) /var/log/sid_changes.log, what the hell ?? I've being sitting on it from morning and nothing... still I can't find the reason :(</p>
<p> </p>
<p>Robert</p>
<p> </p>
<p> </p>
<p> </p>
<p> </p><br>



<br>------------------------------------------------------------------------------<br>
<br>_______________________________________________<br>
Snort-users mailing list<br>
<a href="mailto:Snort-users@lists.sourceforge.net">Snort-users@...4626...ceforge.net</a><br>
Go to this URL to change user options or unsubscribe:<br>
<a href="https://lists.sourceforge.net/lists/listinfo/snort-users" target="_blank">https://lists.sourceforge.net/lists/listinfo/snort-users</a><br>
Snort-users list archive:<br>
<a href="http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users" target="_blank">http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users</a><br>
<br>
Please visit <a href="http://blog.snort.org" target="_blank">http://blog.snort.org</a> to stay current on all the latest Snort news!<br></blockquote></div>