RE: Snort 1.81 and MYSQL compile problems.

["Cessna, Michael" <MCessna () rtm com>]

I had this problem when I installed Snort 1.8.1 on RedHat 7.
First make sure that zlib is installed on the system, then recompile snort.
If you still get the error add the --with-zlib to the compile command and
that should take care of it.
Mike
-----Original Message-----
From: Craig Simon [mailto:craigs () craigsimon net]
Sent: Monday, October 29, 2001 5:40 PM
To: snort-users () lists sourceforge net
Subject: [Snort-users] Snort 1.81 and MYSQL compile problems.


Greetings everyone, and let me apologize in advance if this one has been
answered already.  I have been unable to find it if it has!
 
I am trying to build a new firewall, and I plan on it including Snort and
Demarc.  Now I have been running snort for a while and it has been working
well. Now I need to compile it with mysql support, and I am having some
issues.
 
 
This is on Debian (Testing) with a custom compiled 2.4.13 kernel.  I have
FreeS/wan compiled into the kernel (just not configured now).  I installed
the latest binary distribution of mysql from mysql.com which is 3.23.43.
 
My configure command (from the demark docs) is pretty simple.
./configure --with-mysql=/usr/local/mysql --prefix=/usr/local/snort/
 
It seems to go fine, including finding mysql.
 
The error is on make
 
gcc -DHAVE_CONFIG_H -I. -I. -I. -I/usr/include/pcap
-I/usr/local/mysql/include -DENABLE_MYSQL  -g -O2 -Wall -c spp_arpspoof.c
gcc -DHAVE_CONFIG_H -I. -I. -I. -I/usr/include/pcap
-I/usr/local/mysql/include -DENABLE_MYSQL  -g -O2 -Wall -c spo_idmef.c
gcc -DHAVE_CONFIG_H -I. -I. -I. -I/usr/include/pcap
-I/usr/local/mysql/include -DENABLE_MYSQL  -g -O2 -Wall -c spo_SnmpTrap.c
gcc  -g -O2 -Wall -L/usr/local/mysql/lib -o snort  snort.o log.o decode.o
mstring.o rules.o plugbase.o sp_pattern_match.o sp_tcp_flag_check.o
sp_icmp_type_check.o sp_icmp_code_check.o sp_ttl_check.o sp_ip_id_check.o
sp_tcp_ack_check.o sp_tcp_seq_check.o sp_dsize_check.o spp_http_decode.o
spp_portscan.o sp_ipoption_check.o sp_rpc_check.o sp_icmp_id_check.o
sp_icmp_seq_check.o sp_respond.o spo_alert_syslog.o spo_log_tcpdump.o
spo_database.o sp_session.o spp_defrag.o parser.o spo_alert_fast.o
spo_alert_full.o spo_alert_smb.o spo_alert_unixsock.o sp_react.o spo_xml.o
sp_ip_tos_check.o snprintf.o checksum.o spp_tcp_stream2.o sp_reference.o
sp_ip_fragbits.o spp_anomsensor.o tag.o spp_unidecode.o codes.o strlcpyu.o
strlcatu.o debug.o sp_tcp_win_check.o spp_rpc_decode.o spp_bo.o
spp_telnet_negotiation.o spo_csv.o sp_ip_same_check.o sp_priority.o
sp_ip_proto.o ubi_BinTree.o ubi_SplayTree.o spo_unified.o spp_stream4.o
spp_frag2.o spp_arpspoof.o spo_idmef.o spo_SnmpTrap.o  -lpcap -lm -lnsl
-lmysqlclient
/usr/local/mysql/lib/libmysqlclient.a(my_compress.o): In function
`my_uncompress':
my_compress.o(.text+0x9a): undefined reference to `uncompress'
/usr/local/mysql/lib/libmysqlclient.a(my_compress.o): In function
`my_compress_alloc':
my_compress.o(.text+0x12a): undefined reference to `compress'
collect2: ld returned 1 exit status
make: *** [snort] Error 1
 
Now interestingly enough, I just noticed this when I was looking at the
output of my configure.
 
checking for compress in -lz... no
 
I just don't know if it means anything.
 
Any help would be appreciated.
 
Thanks Everyone
 
Craig