Re: Dynamic rules not initialized properly

[Y M <snort () outlook com>]

Hi,
Have you ran a rules update lately? Specifically to the Dynamic Rules? The reason I am asking is because I get this 
error when I jack with the .so rules. For example, I got the same error today on a test box. What I did was when I 
updated the rules (including Dynamic Rules) using PulledPork I forgot to tell PulledPork to process only text rules 
(using -T) with a SIGHUP to reload Snort since it is running already. Dynamic Rules are not reloadable, so I had to 
stop Snort, re-run PulledPork and then start Snort again and the messages disappeared (ahem, need to double check)
I am not sure if this is the same scenario you are facing but hope it helps.

From: Hanson.Webster () salemfive com
To: snort-users () lists sourceforge net
Date: Mon, 7 Oct 2013 12:54:15 -0400
Subject: [Snort-users] Dynamic rules not initialized properly

When I view /var/log/messages, the following two errors are constantly getting written to the log, and the system stops 
logging to our syslog collector Dynamic Rule [3:8351] was not initialized properly.Dynamic Rule [3:16533] was not 
initialized properly. If I restart snort, the errors go away, but it happens again the next day.  How can I fix this? 
Hanson M. Webster | Network and Security Analyst | Salem Five Bank | 210 Essex Street, Salem MA 01970 | Tel: 978.720. 
5230 | Fax: 978.498.0230 | www.salemfive.com This information may be confidential and/or privileged.  Use of this 
information by anyone other than the intended recipient is prohibited.  If you receive this message in error, please 
inform the sender and remove any record of this message. 
------------------------------------------------------------------------------
October Webinars: Code for Performance
Free Intel webinars can help you accelerate application performance.
Explore tips for MPI, OpenMP, advanced profiling, and more. Get the most from 
the latest Intel processors and coprocessors. See abstracts and register >
http://pubads.g.doubleclick.net/gampad/clk?id=60134791&iu=/4140/ostg.clktrk
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!                                        

------------------------------------------------------------------------------
October Webinars: Code for Performance
Free Intel webinars can help you accelerate application performance.
Explore tips for MPI, OpenMP, advanced profiling, and more. Get the most from 
the latest Intel processors and coprocessors. See abstracts and register >
http://pubads.g.doubleclick.net/gampad/clk?id=60134791&iu=/4140/ostg.clktrk

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!