Re: snort FATAL errors on start

[Erek Adams <erek () theadamsfamily net>]

On Sun, 1 Sep 2002, Donnie Green wrote:

> I am running snort-1.8.7 on RH 7.3 (libpcap-0.6.2-12).  When I attempt to
> start snort, I get the following errors:
> Sep  1 20:42:14 pandora snort: Initializing daemon mode
> Sep  1 20:42:14 pandora snortd: snort startup succeeded
> Sep  1 20:42:14 pandora snort: PID stat checked out ok, PID set to /var/run/
> Sep  1 20:42:14 pandora snort: Writing PID file to "/var/run/"
> Sep  1 20:42:14 pandora snort: FATAL ERROR: ERROR /etc/snort/snort.conf(242)
> => Unknown argument to http_decode preprocessor: "unicode"
> Sep  1 20:42:14 pandora kernel: device eth0 left promiscuous mode
>
> Also, when I attempt to stop snort I get the following error:
> Sep  1 20:42:01 pandora snortd: snort shutdown failed
>
> This is strange because this seemed to work out the box on my laptop.  Can
> anyone help?

You're using an older .conf file with a newer version of snort.  When you
update version of snort, you _must_ update to the new version of the .conf.
Many times things will change in the .conf due to code changes.

Also, save yourself a problem later.  Ditch the RPM for libpcap and go get the
version from tcpdump.org.

Cheers!

-----
Erek Adams
Nifty-Type-Guy
TheAdamsFamily.Net



-------------------------------------------------------
This sf.net email is sponsored by: OSDN - Tired of that same old
cell phone?  Get a new here for FREE!
https://www.inphonic.com/r.asp?r=sourceforge1&refcode1=vs3390
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users