HELP: Installing SnortSam with Snort-2.8.0+BASE+Barnyard installed

[Rachmat Hidayat Al-Anshar <rachmat_hidayat_02 () yahoo com>]

<!-- DIV {margin:0px;}-->Hi, Will (^^)...

I absolutely didn't know, is it good sign or bad thing, but, 
when I try to modify 

RegisterPlugin("fwsam", AlertFWsamOptionInit);

to

RegisterPlugin("fwsam",
 AlertFWsamOptionInit,OPT_TYPE_ACTION);

It really works. The error message didn't appear at all.
But, in a specifying opt types u mention, 

OPT_TYPE_ACTION = 0,
OPT_TYPE_LOGGING,
OPT_TYPE_DETECTION,
OPT_TYPE_MAX

can u explain the usage of these ?
thanks in advance

(^^) rachmat


 ----- Original Message ----
From: Will Metcalf <william.metcalf () gmail com>
To: Joel Esler <joel.esler () sourcefire com>
Cc:
Rachmat Hidayat Al-Anshar <rachmat_hidayat_02 () yahoo com>;
Snort-users () lists sourceforge net; snortsam-discussion () snortsam net
Sent: Saturday, November 3, 2007 8:46:05 PM
Subject: Re: [Snort-users] [Snortsam-discussion] HELP: setting up SnortSamrunsSnort-2.8.0+BASE+Barnyard

It appears as if the patch is broken.  It looks like RegisterPlugin
requires an OptType in 2.8 and whoever updated the patch did not
specify one.  so In spo_alert_fwsam.c

RegisterPlugin("fwsam", AlertFWsamOptionInit);

Needs to be something
 like....

RegisterPlugin("fwsam", AlertFWsamOptionInit,OPT_TYPE_ACTION);

here are the opt types you can specify.  I'm not sure which does what,
maybe Joel can clarify the correct one to use.  Need to go pack now,
getting ready for an 11 hour flight ;-)...

        OPT_TYPE_ACTION = 0,
        OPT_TYPE_LOGGING,
        OPT_TYPE_DETECTION,
        OPT_TYPE_MAX

Regards,

Will
On 11/3/07, Joel Esler <joel.esler () sourcefire com> wrote:
> What version of Snort are you running?
> Is SnortSAM compatible with that version?
>
> Did you notice you typed "--with-ysql-libraries" instead of
> "--with-mysql-libraries".
>
> In addition to that, I recommend you do NOT have Snort log directly
 to the
> DB, instead, use Snort to log to unified, then have a separate tool
 named
> "barnyard" to insert the unified files into the DB.
>
> J
>
>
>
> On Nov 3, 2007, at 1:49 AM, Rachmat Hidayat Al-Anshar wrote:
>
>
> All right then,
> I've been trying to going through this process with ignoring the
 warning
> message produced by aclocal.
> The proccess continued
>
> # autoheader
> # automake –add-missing
> # autoconf
> #./configure --enable-dynamicplugin
> --with-mysql-includes=/usr/include/mysql
> --with-ysql-libraries=/usr/lib
>
> and suddenly...
>
> spo_alert_fwsam.c: In function 'AlertFWsamSetup':
> spo_alert_fwsam.c:143: warning: passing arg 3 of
 'RegisterOutputPlugin' from
> incompatible pointer type
> spo_alert_fwsam.c:144: error: too few arguments to function
 'RegisterPlugin'
> spo_alert_fwsam.c: In function 'AlertFWsam':
> spo_alert_fwsam.c:905: warning: passing arg 2 of 'TwoFishEncrypt'
 from
> incompatible pointer type
> spo_alert_fwsam.c:940: warning: passing arg 2 of 'TwoFishDecrypt'
 from
> incompatible pointer type
> spo_alert_fwsam.c:946: warning: passing arg 2 of 'TwoFishDecrypt'
 from
> incompatible pointer type
> spo_alert_fwsam.c:979: warning: passing arg 2 of 'TwoFishDecrypt'
 from
> incompatible pointer type
> spo_alert_fwsam.c:985: warning: passing arg 2 of 'TwoFishDecrypt'
 from
> incompatible pointer type
> spo_alert_fwsam.c: In function 'FWsamCheckOut':
> spo_alert_fwsam.c:1141: warning: passing arg 2 of 'TwoFishEncrypt'
 from
> incompatible pointer type
> spo_alert_fwsam.c:1157: warning: passing arg 2 of 'TwoFishDecrypt'
 from
> incompatible pointer type
> spo_alert_fwsam.c:1163: warning: passing arg 2 of 'TwoFishDecrypt'
 from
> incompatible pointer type
> spo_alert_fwsam.c: In function 'FWsamCheckIn':
> spo_alert_fwsam.c:1274: warning: passing arg 2 of 'TwoFishEncrypt'
 from
> incompatible pointer type
> spo_alert_fwsam.c:1293: warning: passing arg 2 of 'TwoFishDecrypt'
 from
> incompatible pointer type
> make[3]: *** [spo_alert_fwsam.o] Error 1
> make[3]: Leaving directory
 '/research/snort/snort-2.8.0/src/output-plugins'
> make[2]: *** [all-recursive] Error 1
> make[2]: Leaving directory '/research/snort/snort-2.8.0/src'
> make[1]: *** [all-recursive] Error 1
> make[1]: Leaving directory '/research/snort/snort-2.8.0'
> make: *** [all] Error 2
>
> What's wrong with snort?!
> How to solve this?
>
> Any response will be appreciated
> Thanks
> (^^!) Mat
>
> __________________________________________________
> Do You Yahoo!?
> Tired of spam? Yahoo! Mail has the best spam protection around
> http://mail.yahoo.com
 -------------------------------------------------------------------------
> This SF.net email is sponsored by: Splunk Inc.
> Still grepping through log files to find problems?  Stop.
> Now Search log events and configuration files using AJAX and a
 browser.
> Download your FREE copy of Splunk now >>
> http://get.splunk.com/_______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users
 -------------------------------------------------------------------------
> This SF.net email is sponsored by: Splunk Inc.
> Still grepping through log files to find problems?  Stop.
> Now Search log events and configuration files using AJAX and a
 browser.
> Download your FREE copy of Splunk now >> http://get.splunk.com/
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users





__________________________________________________
Do You Yahoo!?
Tired of spam?  Yahoo! Mail has the best spam protection around
 
http://mail.yahoo.com 


__________________________________________________
Do You Yahoo!?
Tired of spam?  Yahoo! Mail has the best spam protection around 
http://mail.yahoo.com

-------------------------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems?  Stop.
Now Search log events and configuration files using AJAX and a browser.
Download your FREE copy of Splunk now >> http://get.splunk.com/

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users