Re: Startup Problem

[Michael Boman <michael () ayeka dyndns org>]

On Sun, 2004-04-04 at 02:32,
eric-dated-1083277626.193075aa63e273 () catastrophe net wrote:
> I'm having a startup problem here with snort..the error message I
> get is the following...
>
>  Apr  3 12:12:16 pluto snort: FATAL ERROR:
>  /var/snort/etc/snort.conf(34) => Invalid configuration token
>  'server'.  The first configuration must start with a 'global'
>  configuration type.
>
> This is when I try to start snort with the following syntax.
>
>  # /var/snort/bin/snort -c /var/snort/etc/snort.conf \
>    -i em1 -Cbd -t /var/snort -l /var/snort/log/em1
[snip]
> include $RULE_PATH/local.rules
> include classification.config
> include reference.config

Just for the record (solved this over IRC): rules should be included at
the end of snort.conf, *after* classification.config, reference.config
and others.

Rule of thumb: rules are to be the last thing you include in snort.conf
(unless you *really* know what you are doing)

-- 
Michael Boman

Attachment: signature.asc
Description: This is a digitally signed message part