Snort mailing list archives
RE: SEGV fault with Solaris 9/Snort 2.6.0RC1
From: "Miner, Jonathan W (CSC) (US SSA)" <jonathan.w.miner () baesystems com>
Date: Tue, 25 Apr 2006 12:34:48 -0400
I have found a work-around to the problem.... It turns out that unless I specify the interface name on the command line, pv.interface was being set to 0x0, ie the NULL pointer. This in turned caused escapedInterfaceName to also be set to NULL. When I specify "-i hme0" on the command line, then pv.interface gets set, and everyone downstream is happy; snort starts up, and alerts are getting logged to the database. -----Original Message----- From: Justin Heath [mailto:jheath () sourcefire com] Sent: Tue 04/25/2006 10:44 AM To: snort-users () lists sourceforge net Cc: Miner, Jonathan W (CSC) (US SSA); snort-beta () sourcefire com Subject: Re: [Snort-users] SEGV fault with Solaris 9/Snort 2.6.0RC1 2.6 requires a schema change so you will need to update that if you have not done so already. If you still see the issue after updating the schema add --enable-debug to your configure arguments and send in the stack trace. Thanks, Justin Heath On Tuesday 25 April 2006 09:41, Miner, Jonathan W (CSC) (US SSA) wrote:
Hi - I'm just starting to test version 2.6.0RC, and I'm getting a SEGV when trying to parse the "output directive" in my snort.conf file. /var/adm/messages: Apr 24 16:14:43 outcast snort[11235]: [ID 702911 daemon.notice] *** Apr 24 16:14:43 outcast snort[11235]: [ID 702911 daemon.notice] *** Snort caught a SEGV exception, shutting down. Apr 24 16:14:43 outcast snort[11235]: [ID 702911 daemon.notice] *** SEGV caught while parsing '../rules/snort.conf' at line 684. Output from `cat -n snort.conf`: 1 #-------------------------------------------------- 2 # http://www.snort.org Snort current Ruleset 3 # Contact: snort-sigs () lists sourceforge net 4 #-------------------------------------------------- 5 # $Id: snort.conf,v 1.165 2006/03/15 18:56:59 ssturges Exp $ . . . 679 # database: log to a variety of databases 680 # --------------------------------------- 681 # See the README.database file for more information about configuring 682 # and using this plugin. 683 # 684 output database: log, mysql, user=snort password=AbCdE@fGh dbname=snort host=localhost 685 # output database: alert, postgresql, user=snort dbname=snort This is exact same syntax I've used with version 2.4.3, and I'm using the snort.conf file that came with the 2.6.0RC1 tar file. Changing the password to something invalid still results in the SEGV. What am I missing? ------------------------------------------------------- Using Tomcat but need to do more? Need to support web services, security? Get stuff done quickly with pre-integrated technology to make your job easier Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo http://sel.as-us.falkag.net/sel?cmd=lnk&kid0709&bid&3057&dat1642 _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
------------------------------------------------------- Using Tomcat but need to do more? Need to support web services, security? Get stuff done quickly with pre-integrated technology to make your job easier Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo http://sel.as-us.falkag.net/sel?cmd=lnk&kid0709&bid&3057&dat1642 _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- SEGV fault with Solaris 9/Snort 2.6.0RC1 Miner, Jonathan W (CSC) (US SSA) (Apr 25)
- Re: SEGV fault with Solaris 9/Snort 2.6.0RC1 Justin Heath (May 10)
- RE: SEGV fault with Solaris 9/Snort 2.6.0RC1 Miner, Jonathan W (CSC) (US SSA) (Apr 25)
- RE: SEGV fault with Solaris 9/Snort 2.6.0RC1 Miner, Jonathan W (CSC) (US SSA) (Apr 25)
- Re: SEGV fault with Solaris 9/Snort 2.6.0RC1 Steven Sturges (May 10)
- Re: SEGV fault with Solaris 9/Snort 2.6.0RC1 Justin Heath (May 10)