Snort mailing list archives
HELP: Installing SnortSam with Snort-2.8.0+BASE+Barnyard installed
From: Rachmat Hidayat Al-Anshar <rachmat_hidayat_02 () yahoo com>
Date: Thu, 8 Nov 2007 23:41:33 -0800 (PST)
<!-- DIV {margin:0px;}-->Hi, Will (^^)... I absolutely didn't know, is it good sign or bad thing, but, when I try to modify RegisterPlugin("fwsam", AlertFWsamOptionInit); to RegisterPlugin("fwsam", AlertFWsamOptionInit,OPT_TYPE_ACTION); It really works. The error message didn't appear at all. But, in a specifying opt types u mention, OPT_TYPE_ACTION = 0, OPT_TYPE_LOGGING, OPT_TYPE_DETECTION, OPT_TYPE_MAX can u explain the usage of these ? thanks in advance (^^) rachmat ----- Original Message ---- From: Will Metcalf <william.metcalf () gmail com> To: Joel Esler <joel.esler () sourcefire com> Cc: Rachmat Hidayat Al-Anshar <rachmat_hidayat_02 () yahoo com>; Snort-users () lists sourceforge net; snortsam-discussion () snortsam net Sent: Saturday, November 3, 2007 8:46:05 PM Subject: Re: [Snort-users] [Snortsam-discussion] HELP: setting up SnortSamrunsSnort-2.8.0+BASE+Barnyard It appears as if the patch is broken. It looks like RegisterPlugin requires an OptType in 2.8 and whoever updated the patch did not specify one. so In spo_alert_fwsam.c RegisterPlugin("fwsam", AlertFWsamOptionInit); Needs to be something like.... RegisterPlugin("fwsam", AlertFWsamOptionInit,OPT_TYPE_ACTION); here are the opt types you can specify. I'm not sure which does what, maybe Joel can clarify the correct one to use. Need to go pack now, getting ready for an 11 hour flight ;-)... OPT_TYPE_ACTION = 0, OPT_TYPE_LOGGING, OPT_TYPE_DETECTION, OPT_TYPE_MAX Regards, Will On 11/3/07, Joel Esler <joel.esler () sourcefire com> wrote:
What version of Snort are you running? Is SnortSAM compatible with that version? Did you notice you typed "--with-ysql-libraries" instead of "--with-mysql-libraries". In addition to that, I recommend you do NOT have Snort log directly
to the
DB, instead, use Snort to log to unified, then have a separate tool
named
"barnyard" to insert the unified files into the DB. J On Nov 3, 2007, at 1:49 AM, Rachmat Hidayat Al-Anshar wrote: All right then, I've been trying to going through this process with ignoring the
warning
message produced by aclocal. The proccess continued # autoheader # automake –add-missing # autoconf #./configure --enable-dynamicplugin --with-mysql-includes=/usr/include/mysql --with-ysql-libraries=/usr/lib and suddenly... spo_alert_fwsam.c: In function 'AlertFWsamSetup': spo_alert_fwsam.c:143: warning: passing arg 3 of
'RegisterOutputPlugin' from
incompatible pointer type spo_alert_fwsam.c:144: error: too few arguments to function
'RegisterPlugin'
spo_alert_fwsam.c: In function 'AlertFWsam': spo_alert_fwsam.c:905: warning: passing arg 2 of 'TwoFishEncrypt'
from
incompatible pointer type spo_alert_fwsam.c:940: warning: passing arg 2 of 'TwoFishDecrypt'
from
incompatible pointer type spo_alert_fwsam.c:946: warning: passing arg 2 of 'TwoFishDecrypt'
from
incompatible pointer type spo_alert_fwsam.c:979: warning: passing arg 2 of 'TwoFishDecrypt'
from
incompatible pointer type spo_alert_fwsam.c:985: warning: passing arg 2 of 'TwoFishDecrypt'
from
incompatible pointer type spo_alert_fwsam.c: In function 'FWsamCheckOut': spo_alert_fwsam.c:1141: warning: passing arg 2 of 'TwoFishEncrypt'
from
incompatible pointer type spo_alert_fwsam.c:1157: warning: passing arg 2 of 'TwoFishDecrypt'
from
incompatible pointer type spo_alert_fwsam.c:1163: warning: passing arg 2 of 'TwoFishDecrypt'
from
incompatible pointer type spo_alert_fwsam.c: In function 'FWsamCheckIn': spo_alert_fwsam.c:1274: warning: passing arg 2 of 'TwoFishEncrypt'
from
incompatible pointer type spo_alert_fwsam.c:1293: warning: passing arg 2 of 'TwoFishDecrypt'
from
incompatible pointer type make[3]: *** [spo_alert_fwsam.o] Error 1 make[3]: Leaving directory
'/research/snort/snort-2.8.0/src/output-plugins'
make[2]: *** [all-recursive] Error 1 make[2]: Leaving directory '/research/snort/snort-2.8.0/src' make[1]: *** [all-recursive] Error 1 make[1]: Leaving directory '/research/snort/snort-2.8.0' make: *** [all] Error 2 What's wrong with snort?! How to solve this? Any response will be appreciated Thanks (^^!) Mat __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com
-------------------------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc. Still grepping through log files to find problems? Stop. Now Search log events and configuration files using AJAX and a
browser.
Download your FREE copy of Splunk now >> http://get.splunk.com/_______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
-------------------------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc. Still grepping through log files to find problems? Stop. Now Search log events and configuration files using AJAX and a
browser.
Download your FREE copy of Splunk now >> http://get.splunk.com/ _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
__________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com
------------------------------------------------------------------------- This SF.net email is sponsored by: Splunk Inc. Still grepping through log files to find problems? Stop. Now Search log events and configuration files using AJAX and a browser. Download your FREE copy of Splunk now >> http://get.splunk.com/
_______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- HELP: Installing SnortSam with Snort-2.8.0+BASE+Barnyard installed Rachmat Hidayat Al-Anshar (Nov 08)