Re: Ubuntu 18 and so rules error

[James Lay <jlay () slave-tothe-box net>]

Alas I got the same results: 

An error occurred: Loading dynamic detection library
/opt/snort/lib/snort_dynamicrules/protocol-dns.so... ERROR: Failed to
load /opt/snort/lib/snort_dynamicrules/protocol-dns.so:
/opt/snort/lib/snort_dynamicrules/protocol-dns.so: undefined symbol: log


file info: 

-rwxr-xr-x 1 root root 445824 Jun 18 11:28
/opt/snort/lib/snort_dynamicrules/protocol-dns.so 

My snort was compiled like so: 

./configure --prefix=/opt/snort --enable-non-ether-decoders
--enable-sourcefire --enable-shared-rep --enable-control-socket
--enable-file-inspect --with-daq-includes=/opt/daq/include
--with-daq-libraries=/opt/daq/lib
--with-dnet-includes=/opt/libdnet/include
--with-dnet-libraries=/opt/libdnet/lib 

libdnet like so: 

./configure --prefix=/opt/libdnet CFLAGS=-fPIC -g -O2 

and daq like so: 

./configure --prefix=/opt/daq 

That info might help.  If you'd like and have the time Patrick ping me
off list and I can get you ssh access and you can go to town...thank
you! 

James 

On 2018-06-19 09:57, James Lay wrote:

> Thanks Patrick...will test on that dev box today and report my findings. 
>
> James 
>
> On 2018-06-18 13:25, Patrick Mullen (pamullen) wrote: 
>
> James, Y M, and anyone else experiencing this issue. 
>
> We've made a build change from feedback given to me by Russ, so please report back after our next release, which 
> should be some time tomorrow, Tuesday, 19 June, and let me know if the issue has been resolved.  Unfortunately, I 
> don't have the issue myself so I can't test it, but it should fix it.  :crosses fingers:  Thanks for your patience 
> and assistance. 
>
> Thanks, 
>
> ~Patrick 
>
> FROM: "Patrick Mullen (pamullen)" <pamullen () cisco com>
> DATE: Friday, June 15, 2018 at 1:13 PM
> TO: "jlay () slave-tothe-box net" <jlay () slave-tothe-box net>
> CC: "snort-users () lists snort org" <snort-users () lists snort org>
> SUBJECT: Re: [Snort-users] Ubuntu 18 and so rules error 
>
> James, 
>
> I'm at a loss.  Let me google and think about this and get back to you.  Maybe it's a a versioning issue? 
>
> Anyone else have/seen this issue? 
>
> Thanks, 
>
> ~Patrick 
>
> FROM: James Lay <jlay () slave-tothe-box net>
> REPLY-TO: "jlay () slave-tothe-box net" <jlay () slave-tothe-box net>
> DATE: Thursday, June 14, 2018 at 5:44 PM
> TO: "Patrick Mullen (pamullen)" <pamullen () cisco com>
> CC: "snort-users () lists snort org" <snort-users () lists snort org>
> SUBJECT: Re: [Snort-users] Ubuntu 18 and so rules error 
>
> Yes....of note I am not compiling the rules, just using pulled pork to do it's thing. 
>
> James 
>
> On 2018-06-14 08:50, Patrick Mullen (pamullen) wrote: 
>
> To be clear, my example code ran first try?  Does snort continue to throw that error? 
>
> ~Patrick 
>
> FROM: James Lay <jlay () slave-tothe-box net> 
>
> Ran like a champ: 
>
> <snip screenshot> 
>
> now we're having some fun! 
>
> James 
>
> On 2018-06-13 09:20, Patrick Mullen (pamullen) wrote: 
>
> James, 
>
> Here's a quick test.  If this doesn't work, then install whatever google tells you and it should fix the snort 
> loading problem.  If it does, then I'm a little confused and we'll have to look into this further.

_______________________________________________
Snort-users mailing list
Snort-users () lists snort org
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

Please visit http://blog.snort.org to stay current on all the latest
Snort news!

Please follow these rules:
https://snort.org/faq/what-is-the-mailing-list-etiquette 

_______________________________________________
Snort-users mailing list
Snort-users () lists snort org
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette