Snort mailing list archives
Re: snort rules not being read
From: twig les <twigles () yahoo com>
Date: Wed, 4 Sep 2002 09:06:51 -0700 (PDT)
1. What did you do to make snort start at boot? Show us the script and where you put it. 2. What is the RULE_PATH specified in your snort.conf? --- Donnie Green <d_greenjr () hotmail com> wrote:
I'm running RH7.3, snort-1.8.7, logging to /var/log/snort. I have two problems: (1)When I boot Linux, snort does not start up and (2) I cannot get snort to read in the rules even if I use the command "snort -i eth0 -c /etc/snort" after booting. Below is a portion of the output of preceeding command. Does anyone have a configuration that works?? hostname# snort -i eth0 -c /etc/snort Log directory = /var/log/snort Initializing Network Interface eth0 --== Initializing Snort ==-- Decoding Ethernet on interface eth0 Initializing Preprocessors! Initializing Plug-ins! Initializating Output Plugins! Parsing Rules file /etc/snort +++++++++++++++++++++++++++++++++++++++++++++++++++ Initializing rule chains... 0 Snort rules read... 0 Option Chains linked into 0 Chain Headers 0 Dynamic rules +++++++++++++++++++++++++++++++++++++++++++++++++++ Rule application order: ->activation->dynamic->alert->pass->log --== Initialization Complete ==-- -*> Snort! <*- Version 1.8.7 (Build 128)
_________________________________________________________________
MSN Photos is the easiest way to share and print your photos: http://photos.msn.com/support/worldwide.aspx
-------------------------------------------------------
This sf.net email is sponsored by: OSDN - Tired of that same old cell phone? Get a new here for FREE!
https://www.inphonic.com/r.asp?r=sourceforge1&refcode1=vs3390
_______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users ===== ----------------------------------------------------------- Heavy metal made me do it. ----------------------------------------------------------- __________________________________________________ Do You Yahoo!? Yahoo! Finance - Get real-time stock quotes http://finance.yahoo.com ------------------------------------------------------- This sf.net email is sponsored by: OSDN - Tired of that same old cell phone? Get a new here for FREE! https://www.inphonic.com/r.asp?r=sourceforge1&refcode1=vs3390 _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- snort rules not being read Donnie Green (Sep 03)
- Re: snort rules not being read twig les (Sep 04)
- RE: snort rules not being read Michael Steele (Sep 04)
- <Possible follow-ups>
- RE: snort rules not being read Donnie Green (Sep 04)
- RE: snort rules not being read Bill Gercken (Sep 05)
- RE: snort rules not being read Donnie Green (Sep 05)
- Re: snort rules not being read John Sage (Sep 08)