Snort mailing list archives
Re: Fatal error when starting snort on the sensor
From: sekure <sekure () gmail com>
Date: Fri, 17 Sep 2004 14:30:28 -0400
I would look for the word "ports" in your snort.conf. Discounting all the comments, there is only one place that I have the word "ports" in my snort.conf, and that's where I define http_inspect preprocessor. So go there and make sure that if you commented out http_inspect, you also commented out everything below it. Or if it isn't uncommented, make sure that there is a "\" character at the end of the line directly above the line starting with "ports" So, either this: preprocessor http_inspect_server: server default \ ports { 80 8080 } Or this: # preprocessor http_inspect_server: server default \ # ports { 80 8080 } NOT THIS: preprocessor http_inspect_server: server default <--*****BACKSLASH MISSING**** ports { 80 8080 } ----- Original Message ----- From: Juan Fernandez <juan.fernandez () deltathree com> Date: Fri, 17 Sep 2004 21:11:13 +0300 Subject: [Snort-users] Fatal error when starting snort on the sensor To: "snort-users () lists sourceforge net" <snort-users () lists sourceforge net> Hi Guys!! When I start snort manually from the command line /etc/init.d/snort start I see that snort starts: Starting Intrusion Database System: SNORT SNORT is up and running! On /var/log/messeges I see: Sep 17 21:02:54 sensjrlan snort: FATAL ERROR: /etc/snort/snort.conf(458) => Unknown rule type: ports In snort.conf the 458 line is this: output database: alert, mysql, user=snort password=snort dbname=snort host=208.170.171.199 sensor_name=sensjrlan Mysql and acid are on another server (208.170.171.199) I checked that I can telnet to port 3306 so what's wrong ? Thanks very much!!! ------------------------------------------------------- This SF.Net email is sponsored by: YOU BE THE JUDGE. Be one of 170 Project Admins to receive an Apple iPod Mini FREE for your judgement on who ports your project to Linux PPC the best. Sponsored by IBM. Deadline: Sept. 24. Go here: http://sf.net/ppc_contest.php _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- Fatal error when starting snort on the sensor Juan Fernandez (Sep 17)
- Re: Fatal error when starting snort on the sensor sekure (Sep 17)
- Message not available
- Re: Fatal error when starting snort on the sensor Matt Kettler (Sep 17)
- <Possible follow-ups>
- Fatal error when starting snort on the sensor Juan Fernandez (Sep 17)
- Re: Fatal error when starting snort on the sensor Jason (Sep 17)
- Re: Fatal error when starting snort on the sensor Joel Esler (Sep 20)
- Re: Fatal error when starting snort on the sensor sekure (Sep 20)