Re: snort causes "modprobe: can't locate.." in syslog

[Ian Jones <ian () dsl081-056-052 dsl-isp net>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


I have seen the same problem. I assumed it was one of my home-grown log 
parsers/daemons...actually it appears that it is, based on what you are 
saying.

I see the same thing and have since 1.7-beta-something. I esentially run two 
snorts because I have snort and then I have a unixsock reader which is 
basically snort with a modified main().

Does anyone know how to turn on debugging for the kernel module autoloader?


On Thursday 26 July 2001 19:04, John Sage wrote:
> Sometimes I'm starting a second process, yes, and sometimes not.
>
> I think you're on the right track though, this has got something to do
> with how snort 1.8.1-b4 sees (or wants to see..) ppp0 or $HOME_NET or
> something like that.
>
> Thanks for bringing up the ppp0 idea -- that's what I'm going to look at
> next.
>
> > down the syslog message ("modprobe: Can't locate module
> > > [reading from a   ") created by snort 1.8.1.beta4, to its being generated
> > > when I run a secondary set of rules against all packets logged over an
> > > extended period of time by my primary rule sets.
> > >
> > > So what about all this is trying to locate a module?

-----BEGIN PGP SIGNATURE-----
Comment: Keeping the world safe for geeks.

iD8DBQE7YNSZwBVKl/Nci0oRAkbpAJ9OGatVYFmOAh7Tw4oux5AVx6gUNwCgzvAz
dPU6+c3yMA1fQ1yluaZ3Z28=
=4sQI
-----END PGP SIGNATURE-----

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
http://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users