RE: Ref Error 1067

["Michael Steele" <michaels () winsnort com>]

Bill,

It shouldn't make any difference about the rules, of course if you have an
include pointing to a non-existent .rules file Snort will fail to start at
all. As long as the includes match an existing .rules file then there should
be no problem, unless of course there is an error in one of the rules.

These are the correct settings for the rules in snort.conf for Windows.

var RULE_PATH d:\IDS\Snort\rules

include $RULE_PATH/nntp.rules

Note: I'm assuming that you meant "$rule_path\" instead of "$rule_set\"?

To check your configuration from the command prompt type:

<FULL_PATH>\snort.exe -c <FULL_PATH>\snort.conf -l <FULL_PATH>\log -ix -T

Note: I the switch '-ix' the 'x' is the interface number that can be derived
from using: '<FULL_PATH>\snort.exe -W'

Error 1067 is usually associated with a connection problem. Also be sure to
check your Event Log under Application for the reason.

Cheers...

-Michael Steele
-- 
 System Engineer / Security Support Technician     
 mailto:michaels () winsnort com    
 Website: http://www.winsnort.com
 Snort: Open Source Network IDS - http://www.snort.org

> -----Original Message-----
> From: snort-users-admin () lists sourceforge net [mailto:snort-users-
> admin () lists sourceforge net] On Behalf Of Bill Kaminski
> Sent: Friday, November 07, 2003 5:35 PM
> To: snort-users () lists sourceforge net
> Subject: [Snort-users] Ref Error 1067
>
> Hello snort-users,
>
>   If you encounter errors with this on starting the service, you need
>   to check your rules! Make sure whatever rules you are not using in
>   your .conf file are remd out in the rules file. I.E. AIM_Servers is
>   off in the .conf file make sure it is remd out in the misc.rule or
>   you will get the 1067 error. Also I did change the way the rules
>   path is at the bottom of the snort.conf file.... change from this
>   $rule_set/ to this $rule_set\   My service starts like a champ.
>   Outstanding IDS!!!!
>
> --
> Very Respectfully,
>  Bill
>
> The Bat! 2.00.6
> Windows XP Pro
>
>
>
> -------------------------------------------------------
> This SF.Net email sponsored by: ApacheCon 2003,
> 16-19 November in Las Vegas. Learn firsthand the latest
> developments in Apache, PHP, Perl, XML, Java, MySQL,
> WebDAV, and more! http://www.apachecon.com/
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users




-------------------------------------------------------
This SF.Net email sponsored by: ApacheCon 2003,
16-19 November in Las Vegas. Learn firsthand the latest
developments in Apache, PHP, Perl, XML, Java, MySQL,
WebDAV, and more! http://www.apachecon.com/
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users