Snort mailing list archives

oinkmaster


From: Nicholas Bernstein <nick () docmagic com>
Date: Wed, 03 Dec 2003 13:23:18 -0800

It seems that oinkmaster.pl decided it's running with the -e option, as
it is enabling all of the rules that I disable. As you can imagine, this
makes for a *lot* of that snort it picking up, and generally makes
maintenance a nightmare. 

I use includes in my snort.cf (i.e. include bad-traffic.rules). I'm
running it as 
        
        "/usr/local/bin/oinkmaster.pl -q -b /etc/snort.last/ -o /etc/snort/"

is there something I'm doing wrong? 

Thanks!
Nick
-- 
+---------------------------------------------------------------+
| Nicholas Bernstein            | nick () docmagic com             |
| UNIX Systems Administrator    | http://www.docmagic.com       |
| Document Systems Inc.         |                               |
| gpg: F706 8C4E 78FA DDDD 53A0 019F D983 FE28 2002 D1F3        |
+---------------------------------------------------------------+

Attachment: signature.asc
Description: This is a digitally signed message part


Current thread: