(Snort-users) swatch/snort config

[<sandro.poppi () wacker com>]

Edwin
> Hi Sandro,
>
>   i have installed the swatch rpm package and other perl
> dependent packages
> with no error. i've made some changes in the
> /etc/swatch/swatch.conf based
> on your guideline.
>
>   but i got an error mesg when i tried to run /usr/bin/swatch.
>
>        swatch: cannot read /root/.swatchrc
>        swatch: using default configuration of:
>                   watchfor = /.*/
>                   echo = random
you should use the command line option --config-file /etc/swatch/swatch.conf.
Take a look on the snortd script I wrote.

>   btw, what is the purpose of swatch_old2newrc? is this the
> program that
> runs the swatch.conf?

No swatch.conf is read within swatch. From the swatch_old2newrc perl script:

"This program will convert an swatch version 2 configuration file
into a new style configuration file. I highly reccomend that you
examine the new file before using it."

Ciao,
Sandro


_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users