<div dir="ltr">In the meantime, I've applied the latest Security Onion updates. I had to restart nsm service to get everything back online after, but sostat is now reporting all is well.<div><br></div><div>Retried rule-update and the error message is still there.</div><div><br></div><div>Any additional information I can make a run at tracking down and providing?</div></div><div class="gmail_extra"><br><div class="gmail_quote">On Fri, May 22, 2015 at 6:51 PM, Joel Esler (jesler) <span dir="ltr"><<a href="mailto:jesler@...589..." target="_blank">jesler@...589...</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">



<div dir="auto">
<div>We are going to look into this.  However, everyone is pretty much out of the office until Tuesday. <br>
<br>
<div>--</div>
<div><b>Joel Esler</b> </div>
Sent from my iPhone</div><div><div class="h5">
<div><br>
On May 22, 2015, at 4:28 PM, Shirkdog <<a href="mailto:shirkdog@...14540...27..." target="_blank">shirkdog@...11827...</a>> wrote:<br>
<br>
</div>
<blockquote type="cite">
<div>
<p dir="ltr"><br>
</p>
<p dir="ltr">On May 22, 2015 3:45 PM, "Scott Link" <<a href="mailto:linksg@...17169..." target="_blank">linksg@...17169...</a>> wrote:<br>
><br>
> Hi,<br>
><br>
> Getting the following error message:<br>
> Running PulledPork.<br>
>     Error 422 when fetching <a href="https://www.snort.org/reg-rules/snortrules-snapshot-2972.tar.gz.md5" target="_blank">
https://www.snort.org/reg-rules/snortrules-snapshot-2972.tar.gz.md5</a> at /usr/bin/<a href="http://pulledpork.pl" target="_blank">pulledpork.pl</a> line 463<br>
>     main::md5file(' <oinkcode redacted>', 'snortrules-snapshot-2972.tar.gz', '/tmp/', '<a href="https://www.snort.org/reg-rules/" target="_blank">https://www.snort.org/reg-rules/</a>') called at /usr/bin/<a href="http://pulledpork.pl" target="_blank">pulledpork.pl</a> line 1885<br>
>     <a href="http://code.google.com/p/pulledpork/" target="_blank">http://code.google.com/p/pulledpork/</a><br>
>       _____ ____<br>
>      `----,\    )<br>
>       `--==\\  /    PulledPork v0.7.0 - Swine Flu!<br>
>        `--==\\/<br>
>      .-~~~~-.Y|\\_  Copyright (C) 2009-2013 JJ Cummings<br>
>   @_/        /  66\_  <a href="mailto:cummingsj@...11827..." target="_blank">cummingsj@...846....11827...</a><br>
>     |    \   \   _(")<br>
>      \   /-| ||'--'  Rules give me wings!<br>
>       \_\  \_\\<br>
>  ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~<br>
> Checking latest MD5 for snortrules-snapshot-2972.tar.gz....<br>
><br>
> Searching the archive seems to point to server-side issue. Need anything else?<br>
</p>
<p dir="ltr">Try with Snort version 2.9.7.3<br>
</p>
</div>
</blockquote>
</div></div><blockquote type="cite">
<div><span>------------------------------------------------------------------------------</span><br>
<span>One dashboard for servers and applications across Physical-Virtual-Cloud </span>
<br>
<span>Widest out-of-the-box monitoring support with 50+ applications</span><br>
<span>Performance metrics, stats and reports that give you Actionable Insights</span><br>
<span>Deep dive visibility with transaction tracing using APM Insight.</span><br>
<span><a href="http://ad.doubleclick.net/ddm/clk/290420510;117567292;y" target="_blank">http://ad.doubleclick.net/ddm/clk/290420510;117567292;y</a></span></div>
</blockquote>
<blockquote type="cite">
<div><span>_______________________________________________</span><br>
<span>Snort-users mailing list</span><br>
<span><a href="mailto:Snort-users@lists.sourceforge.net" target="_blank">Snort-users@lists.sourceforge.net</a></span><br>
<span>Go to this URL to change user options or unsubscribe:</span><br>
<span><a href="https://lists.sourceforge.net/lists/listinfo/snort-users" target="_blank">https://lists.sourceforge.net/lists/listinfo/snort-users</a></span><br>
<span>Snort-users list archive:</span><br>
<span><a href="http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users" target="_blank">http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users</a></span><br>
<span></span><br>
<span>Please visit <a href="http://blog.snort.org" target="_blank">http://blog.snort.org</a> to stay current on all the latest Snort news!</span></div>
</blockquote>
</div>

</blockquote></div><br><br clear="all"><div><br></div>-- <br><div class="gmail_signature"><div dir="ltr">Scott Link<div>Manager, ITS Infrastructure Operations Security</div><div>Saint Louis University</div><div><a href="http://www.slu.edu" target="_blank">www.slu.edu</a></div><div>314.977.9713</div></div></div>
</div>