Re: Snort 2.8.4.1 with snortsam on 64bit segfault

[Luis Daniel Lucio Quiroz <luis.daniel.lucio () gmail com>]

Le mercredi 26 août 2009 10:24:22, Gary Pitman a écrit :
> Hello,
> I have Snort running on RHEL5 64bit and after patching for snortsam  it
> will only run for about 5-10 seconds before getting a segfault. The
> strange thing is that I have had the problem of Snort not being able to
> start when adding the "output fwsam" line previously because the patch
> was not used correctly, but now it does start but then dies.
> I do see that the patch added the 3 spo_alert_fwsam.* files in the
> src/output-plugins directory so I am assuming the patch ran correctly. I
> am wondering if the patch is not 64bit friendly. Has anyone had success
> with this version on x64?
>
> -notes
> I do have enough time to start an strace on the snort process before it
> dies but I do not see any useful information.
> This is without any rules calling  for any action by the snortsam plugin.
>
> Thank you,
>
> ---------------------------------------------------------------------------
> --- Let Crystal Reports handle the reporting - Free Crystal Reports 2008
> 30-Day trial. Simplify your report design, integration and deployment - and
> focus on what you do best, core application coding. Discover what's new
> with Crystal Reports now.  http://p.sf.net/sfu/bobj-july
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users

this is a snortsam issue with blowfish compresor rathern than snort.  I've 
patch it in mandriva RPM, you could move patch from it.

Regards,

LD

------------------------------------------------------------------------------
Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day 
trial. Simplify your report design, integration and deployment - and focus on 
what you do best, core application coding. Discover what's new with 
Crystal Reports now.  http://p.sf.net/sfu/bobj-july
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users