Re: Dynamic Rule [X:XXXXX] was not initialized properly.

[waldo kitty <wkitty42 () windstream net>]

On 6/13/2014 11:18 AM, Jeff Meigs wrote:
> Here is some more info though. The Error only occurs at a specific time.
> Presumably the time the rules are downloaded. It will throw the error like 50+
> times  for 3 specific rules(3:29908, 3:16533, 3:8351). I’ve even tried
> suppressing these rules to no avail. These errors are all created at the same
> point in time.  This just started happening about a week ago. We have made no
> adjustments to any file.

this almost sounds like a race condition...

1. what tool are you using to download your rules updates?

2. is this tool processing the download in a separate area and
    then copying the rules to the operational area?

3. does the tool's log file show it is processing during this error period?

4. snort is being restarted after the rules have been updated, right?

-- 
  NOTE: No off-list assistance is given without prior approval.
        Please *keep mailing list traffic on the list* unless
        private contact is specifically requested and granted.

------------------------------------------------------------------------------
HPCC Systems Open Source Big Data Platform from LexisNexis Risk Solutions
Find What Matters Most in Your Big Data with HPCC Systems
Open Source. Fast. Scalable. Simple. Ideal for Dirty Data.
Leverages Graph Analysis for Fast Processing & Easy Data Exploration
http://p.sf.net/sfu/hpccsystems
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!