Snort: Re: Unable to create stub so rules files

[Peter Bates <peter.bates () ucl ac uk>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


Hello all

On 27/11/2012 10:25, C. L. Martinez wrote:
> ERROR: /data/config/etc/idpsnort01//data/config/etc/idpsnort01/so_rules/bad-traffic.rules(0)
> Unable to open rules file
> "/data/config/etc/idpsnort01//data/config/etc/idpsnort01/so_rules/bad-traffic.rules":
> No such file or directory.
The above files are missing.
Not so sure why it appears to be using the directory twice instead 
of just the once as defined in your conf: 

var CONF_PATH /data/config/etc/idpsnort01
var SO_RULE_PATH $CONF_PATH/so_rules
 
Personally I used PulledPork to manage my rules and SOs and then just have

include $RULE_PATH/snort.rules
include $RULE_PATH/so_rules.rules

Instead of include's for all the seperate files.

- -- 
Peter Bates
Senior Information Security Officer   Phone: +44(0)2076792049
Information Services Division         Internal Ext: 32049
University College London
London WC1E 6BT
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.17 (MingW32)
Comment: Using GnuPG with undefined - http://www.enigmail.net/

iQEcBAEBAgAGBQJQtJlpAAoJELhVoVpEMS6RQBkH/j+e0+hfiF447mHtOCtUcrso
y7V1S/xKIcMQLTZwlqxPPb6Fu+UXCu2wW2zHyFopA0nOHmmOo0WCbauBCIRQ5RS4
OnMmvBYoXfpE4MW1z9oWVzh2ltrxuBB89ka9yI7pDMPG/cTQ32coaGN7Fz4BjBj6
0ptCD8ShLJgPr9NeqbJVltiSmg6n1BuOsfte1FfW84pKFe/mWo6hGas730YAwqHj
ytgB61A/ent5AumLcJRoRUMqIHVnrlwgmarVpt3+g/UTSGFKWSv3xPr+jXoNYFp3
cjiDVpSGz72WFeKBAsi9o/Yfl2fkZZ9p/4kPhVIsFg9rfWDA/uqos+Ryc91sRqQ=
=/NHO
-----END PGP SIGNATURE-----


------------------------------------------------------------------------------
Monitor your physical, virtual and cloud infrastructure from a single
web console. Get in-depth insight into apps, servers, databases, vmware,
SAP, cloud infrastructure, etc. Download 30-day Free Trial.
Pricing starts from $795 for 25 servers or applications!
http://p.sf.net/sfu/zoho_dev2dev_nov
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!