Re: Upgrading snort 2.0.* to -> 2.1.2 , and now i cant ....

[Gary_Portnoy () itginc com]

Check your snort.conf.  Looks like there is a garbled string ending in 
"_decode" that snort can't understand.  It should probably be either 
"telnet_decode" or "rpc_decode".  Look for that and make sure it's not 
garbled.

-Gary-

--- Original Message ---
Date: Mon, 7 Jun 2004 03:39:09 -0500 (CDT)
From: =?iso-8859-1?q?soldier=20Mx?= <soldi3rmx () yahoo com mx>
To: snort-users () lists sourceforge net
Subject: [Snort-users] Upgrading snort 2.0.* to -> 2.1.2 , and now i cant 
....

 Hey i upgraded Snort 2.0.5  to 2.1.2 and...

now i cant run Snort...
 I just upgraded, i didnt modify anything.. just 
made the up grade.... i think i have to change
something, but i dont know where to start..

here i show..

root@linux tripwire # /etc/init.d/snort status
 * status:  started
root@linux tripwire # /etc/init.d/snort zap
 * Manually resetting snort to stopped state.
root@linux tripwire # /etc/init.d/snort start
 * Starting snort... 
                   [ ok ]
root@linux tripwire # ps aux |grep snort
root     14550  0.0  0.3  1516  436 pts/2    S 
03:33   0:00 grep snort
root@linux tripwire #


How you can see, the daemon is not running and i get
this in the LOGS...


Jun  7 03:32:55 linux snort: Initializing daemon mode
Jun  7 03:32:55 linux snort: PID path stat checked out
ok, PID path set to /var/run/
Jun  7 03:32:55 linux snort: Writing PID "16857" to
file "/var/run//snort_eth0.pid"
Jun  7 03:32:56 linux snort: FATAL ERROR:  unknown
preprocessor "`k^\^H_decode"
Jun  7 03:32:55 linux kernel: device eth0 entered
promiscuous mode
Jun  7 03:32:56 linux kernel: device eth0 left
promiscuous mode







-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-
This message is for the named person's use only. This communication is for 
informational purposes only and has been obtained from sources believed to 
be reliable, but it is not necessarily complete and its accuracy cannot be 
guaranteed. It is not intended as an offer or solicitation for the purchase
or sale of any financial instrument or as an official confirmation of any
transaction. Moreover, this material should not be construed to contain any
recommendation regarding, or opinion concerning, any security. It may
contain confidential, proprietary or legally privileged information. No
confidentiality or privilege is waived or lost by any mistransmission. If
you receive this message in error, please immediately delete it and all
copies of it from your system, destroy any hard copies of it and notify the
sender. You must not, directly or indirectly, use, disclose, distribute, 
print, or copy any part of this message if you are not the intended 
recipient.  Any views expressed in this message are those of the individual
sender, except where the message states otherwise and the sender is 
authorized to state them to be the views of any such entity.

ITG Inc. reserves the right to monitor and archive all electronic 
communications through its network. 

ITG Inc. Member NASD, SIPC
-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-



-------------------------------------------------------
This SF.Net email is sponsored by the new InstallShield X.
> From Windows to Linux, servers to mobile, InstallShield X is the one
installation-authoring solution that does it all. Learn more and
evaluate today! http://www.installshield.com/Dev2Dev/0504
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users