Re: Error when dumping so_rules with custom path using snort 2.9.7.0

[Sec_Aficionado <secaficionado () gmail com>]

OK, I solved the problem.

My snort.conf file had a line in section 9 (SO rules) saying this:
include $SO_RULE_PATH/so_rules.rules

This file (so_rules.rules) did not exist, however, because I was dumping the rules for the first time in this machine. 
That caused the problem.

I issued the command:
touch so_rules.rules
in that directory and then snort was able to dump the rules without a problem.

SecAficionado

> On Nov 1, 2014, at 2:01 PM, waldo kitty <wkitty42 () windstream net> wrote:
>
> > On 11/1/2014 1:12 AM, Sec_Aficionado wrote:
> >
> > I have double and triple-checked snort.conf to make sure all the paths are
> > correct and there are no extraneous "/etc/" anywhere, but the error persists.
> > Is there a requirement to dump the stubs into /etc/?
>
> snort stuffs that extraneous /etc/ onto paths while trying to find what it has 
> been told to find... something isn't right somewhere...
>
> double-check your command line and the location of the binary so rules that 
> snort is trying to create the rules stubs from...
>
> -- 
>  NOTE: No off-list assistance is given without prior approval.
>        Please *keep mailing list traffic on the list* unless
>        private contact is specifically requested and granted.
>
> ------------------------------------------------------------------------------
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users
>
> Please visit http://blog.snort.org to stay current on all the latest Snort news!
------------------------------------------------------------------------------

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!