Re: Encoded Rule Plugin SID: 16329, GID: 3 not registered properly. Disabling this rule.

[Y M <snort () outlook com>]

The problem may be in Snort not able to find the rules stubs (so_rules/*.rules) associated with SO rules. Does your 
Snort directory have the so_rules directory and Snort is able to read from it?
 
YM
 
> From: steven.vona () navy mil
> To: snort-users () lists sourceforge net
> Date: Wed, 26 Mar 2014 19:14:48 +0000
> Subject: [Snort-users] Encoded Rule Plugin SID: 16329, GID: 3 not registered properly.  Disabling this rule.
>
> I installed snort onto a fresh RHEL6 machine and when I run a test:
>
> snort -T -i eth1 -u snort -g snort -c /etc/snort/snort.conf
>
> I am receiving a lot of the following:
>
> Encoded Rule Plugin SID: 18641, GID: 3 not registered properly.  Disabling this rule.
>
> 327 of those errors show up, which means a lot of my rules are disabled.
>
> I have searched google for the last 3 hours with no luck.  Can anyone point me to what can be causing this?
>
> I am running snort 2.9.6.0 and I have used oinkmaster to update all the rules with 2.9.6.0 rules.
>
>
>
> ------------------------------------------------------------------------------
> Learn Graph Databases - Download FREE O'Reilly Book
> "Graph Databases" is the definitive new guide to graph databases and their
> applications. Written by three acclaimed leaders in the field,
> this first edition is now available. Download your free book today!
> http://p.sf.net/sfu/13534_NeoTech
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users
>
> Please visit http://blog.snort.org to stay current on all the latest Snort news!

------------------------------------------------------------------------------

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!