Re: Config issues

[Edward Borgoyn <e.c.borgoyn () ieee org>]

Hi,
  The default Windows Snort build does NOT have LZMA decompression support
included in the build.

  However, the default snort.conf includes the line:

     decompress_swf { deflate lzma }

  The problem is that the lzma decompression option is not available in
snort and the 'lzma' keyword option is also not available.  Sorry for the
obscure error message under these conditions.  When LZMA is not included
the build, the 'lzma' keyword is simply not valid.

  I hope this helps.

    Ed


On Sat, Aug 12, 2017 at 10:53 AM, Marcin Dulak via Snort-users <
snort-users () lists snort org> wrote:

> Hi,
>
> please always try to use google first to search for answers:
> https://www.google.com/search?q=%22c:%5Csnort%5Cetc%5Csnort.
> conf(329)+%3D%3E+Invalid+keyword+%27%7D%27+for+server+
> configuration.%22&oq=%22c:%5Csnort%5Cetc%5Csnort.conf(
> 329)+%3D%3E+Invalid+keyword+%27%7D%27+for+server+configuration.%22
> There are several discussions pointing to lzma problem.
> Hopefully you find the definitive solution, then post a summary on this
> forum.
> Otherwise I'm sure someone else will come with more answers.
>
> Marcin
>
> On Sat, Aug 12, 2017 at 4:38 PM, Sumit Balodi via Snort-users <
> snort-users () lists snort org> wrote:
>
> > Can't Solve this problem .
> >
> > ttpInspect Config:
> >     GLOBAL CONFIG
> >       Detect Proxy Usage:       NO
> >       IIS Unicode Map Filename: c:\snort\etc\unicode.map
> >       IIS Unicode Map Codepage: 1252
> >       Memcap used for logging URI and Hostname: 150994944
> >       Max Gzip Memory: 838860
> >       Max Gzip Sessions: 2688
> >       Gzip Compress Depth: 65535
> >       Gzip Decompress Depth: 65535
> > ERROR: c:\snort\etc\snort.conf(329) => Invalid keyword '}' for server
> > configuration.
> >
> > Looking forward for your reply.
> >
> > _______________________________________________
> > Snort-users mailing list
> > Snort-users () lists snort org
> > Go to this URL to change user options or unsubscribe:
> > https://lists.snort.org/mailman/listinfo/snort-users
> >
> > Please visit http://blog.snort.org to stay current on all the latest
> > Snort news!
>
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists snort org
> Go to this URL to change user options or unsubscribe:
> https://lists.snort.org/mailman/listinfo/snort-users
>
> Please visit http://blog.snort.org to stay current on all the latest
> Snort news!
_______________________________________________
Snort-users mailing list
Snort-users () lists snort org
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!