Re: Snort error

[Russ Combs <rcombs () sourcefire com>]

The problem is that, although configure found libz, make didn't find it.

Configure doesn't have a --with-libz-libraries so you could try
reconfiguring with this additional option:

    --with-libpcap-libraries=DIR

where DIR is the directory containing libz.a and libz.so.*.  Even though
that says libpcap, it should cause the correct directory to appear in the
make.

Be sure you make clean and then reconfigure.

Alternatives that come to mind are installing libz where libpcap is or
adding links from the libpcap directory to the libz directory.

I'll look into adding suitable --with-libz-* to Snort's configure.

Let me know how it works out.

Thanks
Russ




On Tue, Jul 13, 2010 at 2:46 PM, Nick Moore <nmoore () sourcefire com> wrote:

> Christian,
>
> I didn't run into that error, but as a guess I'd recommend checking to see
> that your libxml2-dev library installed correctly. Try re-installing it from
> yum: "yum install libxml2-dev". If it says already installed, go through the
> list of other supporting packages and make sure they are installed. Last,
> run an update and boot your system afterwards. Then try the ./configure step
> again.
>
> Hope this helps. If it doesn't please reply to the snort users list. If
> you're not already on the Snort Users Mailing list, please consider joining.
> Lots of people WAY smarter than me out there.
>
> Thanks and happy snorting!
>
> Nick
>
> On Tue, Jul 13, 2010 at 9:44 AM, Christian Benjamin <
> christian.benjamin () infolink co tt> wrote:
>
> >  Hi Nick,
> >
> >
> >
> > I have been following your guide to setup snort on a FC 13 box and I am
> > getting some errors, I have searched high and wide for a solution but I am
> > unable to obtain one I am hoping that you can help me. When I am doing the
> > ./configure --enable-tragetbased --enable-dynamicplugin --enable-sourcefire
> > --enable-reload --enable-zlib --enable-gre --enable-mpls --enable-ppm
> > --enable-perfprofiling && make && make install I get an error :
> >
> >
> >
> > make[6]: Entering directory
> > `/usr/local/snort-2.8.6/src/dynamic-plugins/sf_engine'
> >
> > /bin/sh ../../../libtool --tag=CC --mode=link gcc  -g -O2
> > -fvisibility=hidden -fno-strict-aliasing -Wall  -lpcre -o libsf_engine.la-rpath /usr/local/lib/snort_dynamicengine 
> > -module bmh.lo
> > sf_snort_detection_engine.lo sf_snort_plugin_api.lo sf_snort_plugin_byte.lo
> > sf_snort_plugin_content.lo sf_snort_plugin_hdropts.lo
> > sf_snort_plugin_loop.lo sf_snort_plugin_pcre.lo sf_snort_plugin_rc4.lo
> > sfhashfcn.lo sfghash.lo sfprimetable.lo sf_ip.lo  -ldl -lpcre -lpcap -lnsl
> > -lm -lm  -ldl -lz -lpthread
> >
> > gcc -shared  .libs/bmh.o .libs/sf_snort_detection_engine.o
> > .libs/sf_snort_plugin_api.o .libs/sf_snort_plugin_byte.o
> > .libs/sf_snort_plugin_content.o .libs/sf_snort_plugin_hdropts.o
> > .libs/sf_snort_plugin_loop.o .libs/sf_snort_plugin_pcre.o
> > .libs/sf_snort_plugin_rc4.o .libs/sfhashfcn.o .libs/sfghash.o
> > .libs/sfprimetable.o .libs/sf_ip.o  -lpcre -lpcap -lnsl -lm -ldl -lz
> > -lpthread  -Wl,-soname -Wl,libsf_engine.so.0 -o .libs/libsf_engine.so.0.0.0
> >
> > /usr/bin/ld: cannot find -lz
> >
> > collect2: ld returned 1 exit status
> >
> > make[6]: *** [libsf_engine.la] Error 1
> >
> > make[6]: Leaving directory
> > `/usr/local/snort-2.8.6/src/dynamic-plugins/sf_engine'
> >
> > make[5]: *** [all-recursive] Error 1
> >
> > make[5]: Leaving directory
> > `/usr/local/snort-2.8.6/src/dynamic-plugins/sf_engine'
> >
> > make[4]: *** [all] Error 2
> >
> > make[4]: Leaving directory
> > `/usr/local/snort-2.8.6/src/dynamic-plugins/sf_engine'
> >
> > make[3]: *** [all-recursive] Error 1
> >
> > make[3]: Leaving directory `/usr/local/snort-2.8.6/src/dynamic-plugins'
> >
> > make[2]: *** [all-recursive] Error 1
> >
> > make[2]: Leaving directory `/usr/local/snort-2.8.6/src'
> >
> > make[1]: *** [all-recursive] Error 1
> >
> > make[1]: Leaving directory `/usr/local/snort-2.8.6'
> >
> > make: *** [all] Error 2
> >
> >
> >
> > Any help or pointing me in the right direction would be greatly welcomed,
> > thanks in advance.
> >
> >
> >
> >
> >
> > Cheers,
> >
> > *Christian Benjamin*
> >
> > *Systems Administrator *
> >
> > *InfoLink Services Limited*
> >
> > *8th Floor Tatil Building*
> >
> > *11A Maraval Road*
> >
> > *Port of Spain.*
> >
> > *Phone# 628-0750 ext 230*
> >
> > *Fax# 628-1086*
> >
> > *Cell# 743-4692***
>
>
>
> --
> Nick Moore, SFCE, CISSP, CISA
> Sr. Systems Engineer
> Voice 708-336-9041
> Email nick.moore () sourcefire com
> IM    nickgmoore (Yahoo)
>       nickgmoore38 (AIM)
>
>    ,,_
>   o"  )~   Sourcefire - The Creators of Snort
>    ''''
>
> www.sourcefire.com         www.snort.org
>
>
>
> ------------------------------------------------------------------------------
> This SF.net email is sponsored by Sprint
> What will you do first with EVO, the first 4G phone?
> Visit sprint.com/first -- http://p.sf.net/sfu/sprint-com-first
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users
------------------------------------------------------------------------------
This SF.net email is sponsored by Sprint
What will you do first with EVO, the first 4G phone?
Visit sprint.com/first -- http://p.sf.net/sfu/sprint-com-first

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users