Re: Snort 2.9.1.0 on Gentoo; fatal startup error

[NA <dustypath () comcast net>]

It hangs here, the snort_dynamicrules directory is populated.....

 Loading dynamic engine /usr/lib64/snort_dynamicengine/libsf_engine.so...
Sep 29 17:58:27  snorthost  snort[8347]: done
Sep 29 17:58:27  snorthost snort[8347]: Loading all dynamic detection
libs from /usr/lib64/snort_dynamicrules...
Sep 29 17:58:27  snorthosts nort[8347]:   Loading dynamic detection
library /usr/lib64/snort_dynamicrules/web-activex.so...
Sep 29 17:58:27 snorthost  snort[8347]: FATAL ERROR: Failed to load
/usr/lib64/snort_dynamicrules/web-activex.so:
/usr/lib64/snort_dynamicrules/web-activex.so: ELF file OS ABI invalid
Sep 29 17:58:27 snorthost/etc/init.d/snort[8338]: ERROR: snort failed to
start

On 9/29/11 5:24 PM, NA wrote:
> This seems to be similar to the problems I had originally setting up
> Snort. At that time Jason Wallace said to just use the Ubuntu-8-01 as
> the distro variable in pulledpork.conf
>
> Now I can not get that to work. If I use an empty "distro=" variable no
> so_rules are created.
>
> On 9/29/11 2:20 PM, Joel Esler wrote:
> > That error looks like you are using 2.9.0.5 shared object rules with 2.9.1. 
> >
> > --
> > Joel Esler 
> >
> > On Sep 29, 2011, at 16:26, NA <dustypath () comcast net> wrote:
> >
> > > Hello,
> > >
> > > I have just upgraded to Snort 2.9.1.0 and keep getting a Fatal Error
> > > during startup.
> > >
> > >
> > >
> > > Initializing rule chains...
> > > WARNING /etc/snort/rules/snort.rules(4758) The argument 'mime' to
> > > 'file_data' rule option is deprecated.
> > > --Repeated 8 times for different lines/rules---
> > > WARNING /etc/snort/rules/snort.rules(5955) The argument 'mime' to
> > > 'file_data' rule option is deprecated.
> > > WARNING /etc/snort/rules/snort.rules(7595) threshold (in rule) is
> > > deprecated; use detection_filter instead.
> > >
> > >
> > > 18909 Snort rules read
> > >    18534 detection rules
> > >    140 decoder rules
> > >    235 preprocessor rules
> > > 18909 Option Chains linked into 3475 Chain Headers
> > > 0 Dynamic rules
> > > ++++++++++++++++++++++++++++++++++++++
> > >
> > > DynamicPlugin: Rule [3:13287] not enabled in configuration, rule will
> > > not be used
> > > FATAL ERROR: ByteExtract variable 'pop3.stat' in rule [3:16595] is used
> > > before it is defined.
> > >
> > >
> > > Previously I had the same error with 3:13287 but disabled it with
> > > PulledPork:
> > >
> > >
> > > This is also coming up:
> > >
> > > WARNING: ip4 normalizations disabled because not inline
> > > WARNING: tcp normalizations disabled because not inline
> > > WARNING: icmp4 normalizations disabled because not inline
> > > WARNING: ip6 normalizations disabled because not inline
> > > WARNING: icmp6 normalizations disabled because not inline
> > >
> > > I do have config daq: inline and am using  IFACE="eth0:eth1"
> > >
> > >
> > > Thanks for any help,
> > > Bill B
> > >
> > > ------------------------------------------------------------------------------
> > > All the data continuously generated in your IT infrastructure contains a
> > > definitive record of customers, application performance, security
> > > threats, fraudulent activity and more. Splunk takes this data and makes
> > > sense of it. Business sense. IT sense. Common sense.
> > > http://p.sf.net/sfu/splunk-d2dcopy1
> > > _______________________________________________
> > > Snort-users mailing list
> > > Snort-users () lists sourceforge net
> > > Go to this URL to change user options or unsubscribe:
> > > https://lists.sourceforge.net/lists/listinfo/snort-users
> > > Snort-users list archive:
> > > http://www.geocrawler.com/redir-sf.php3?list=snort-users
> > >
> > > Please visit http://blog.snort.org to stay current on all the latest Snort news!


------------------------------------------------------------------------------
All of the data generated in your IT infrastructure is seriously valuable.
Why? It contains a definitive record of application performance, security
threats, fraudulent activity, and more. Splunk takes this data and makes
sense of it. IT sense. And common sense.
http://p.sf.net/sfu/splunk-d2dcopy2
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!