Re: Fwd: error on startup

[waldo kitty <wkitty42 () windstream net>]

On 11/8/2012 14:43, Leonardo Pezente wrote:
> ok im sending the snortd file

that's the snortd file... not the requested snort.conf file :/

> #!/bin/sh
> # $Id$
> #
> # snortd         Start/Stop the snort IDS daemon.
> #
> # chkconfig: 2345 40 60
> # description:  snort is a lightweight network intrusion detection tool that \
> #                currently detects more than 1100 host and network \
> #                vulnerabilities, portscans, backdoors, and more.
> #
>
> # Source function library.
> . /etc/rc.d/init.d/functions
>
> # Source the local configuration file
> . /etc/default/snort
>
> # Convert the /etc/sysconfig/snort settings to something snort can
> # use on the startup line.
> if [ "$ALERTMODE"X = "X" ]; then
>     ALERTMODE=""
> else
>     ALERTMODE="-A $ALERTMODE"
> fi
>
> if [ "$USER"X = "X" ]; then
>     USER="snort"
> fi
>
> if [ "$GROUP"X = "X" ]; then
>     GROUP="snort"
> fi
>
> if [ "$BINARY_LOG"X = "1X" ]; then
>     BINARY_LOG="-b"
> else
>     BINARY_LOG=""
> fi
>
> if [ "$CONF"X = "X" ]; then
>     CONF="-c /root/snort-2.9.3.1/etc/snort.conf"
> else
>     CONF="-c $CONF"
> fi
>
> if [ "$INTERFACE"X = "X" ]; then
>     INTERFACE="-i eth0"
> else
>     INTERFACE="-i $INTERFACE"
> fi
>
> if [ "$DUMP_APP"X = "1X" ]; then
>     DUMP_APP="-d"
> else
>     DUMP_APP=""
> fi
>
> if [ "$NO_PACKET_LOG"X = "1X" ]; then
>     NO_PACKET_LOG="-N"
> else
>     NO_PACKET_LOG=""
> fi
>
> if [ "$PRINT_INTERFACE"X = "1X" ]; then
>     PRINT_INTERFACE="-I"
> else
>     PRINT_INTERFACE=""
> fi
>
> if [ "$PASS_FIRST"X = "1X" ]; then
>     PASS_FIRST="-o"
> else
>     PASS_FIRST=""
> fi
>
> if [ "$LOGDIR"X = "X" ]; then
>     LOGDIR=/var/log/snort
> fi
>
> # These are used by the 'stats' option
> if [ "$SYSLOG"X = "X" ]; then
>     SYSLOG=/var/log/messages
> fi
>
> if [ "$SECS"X = "X" ]; then
>     SECS=5
> fi
>
> if [ ! "$BPFFILE"X = "X" ]; then
>     BPFFILE="-F $BPFFILE"
> fi
>
> ######################################
> # Now to the real heart of the matter:
>
> # See how we were called.
> case "$1" in
>    start)
>          echo -n "Starting snort: "
>          cd $LOGDIR
>          if [ "$INTERFACE" = "-i ALL" ]; then
>             for i in `cat /proc/net/dev|grep eth|awk -F ":" '{ print $1; }'`
>             do
>                  mkdir -p "$LOGDIR/$i"
>                  chown -R $USER:$GROUP $LOGDIR
>                  daemon /usr/sbin/snort $ALERTMODE $BINARY_LOG $NO_PACKET_LOG
> $DUMP_APP -D $PRINT_INTERFACE -i $i -u $USER -g $GROUP $CONF -l $LOGDIR/$i
> $PASS_FIRST $BPFFILE $BPF
>             done
>          else
>             # check if more than one interface is given
>             if [ `echo $INTERFACE|wc -w` -gt 2 ]; then
>                for i in `echo $INTERFACE | sed s/"-i "//`
>                  do
>                    mkdir -p "$LOGDIR/$i"
>                    chown -R $USER:$GROUP $LOGDIR
>                    daemon /usr/sbin/snort $ALERTMODE $BINARY_LOG $NO_PACKET_LOG
> $DUMP_APP -D $PRINT_INTERFACE -i $i -u $USER -g $GROUP $CONF -l $LOGDIR/$i
> $PASS_FIRST $BPFFILE $BPF
>               done
>             else
>                # Run with a single interface (default)
>                daemon /usr/sbin/snort $ALERTMODE $BINARY_LOG $NO_PACKET_LOG
> $DUMP_APP -D $PRINT_INTERFACE $INTERFACE -u $USER -g $GROUP $CONF -l $LOGDIR
> $PASS_FIRST $BPFFILE $BPF
>             fi
>          fi
>          touch /var/lock/snort
>          echo
>          ;;
>    stop)
>          echo -n "Stopping snort: "
>          killall snort
>          rm -f /var/lock/snort
>          echo
>          ;;
>    reload)
>          echo "Sorry, not implemented yet"
>          ;;
>    restart)
>          $0 stop
>          $0 start
>          ;;
>    condrestart)
>          [ -e /var/lock/snort ] && $0 restart
>          ;;
>    status)
>          status snort
>          ;;
>    stats)
>          TC=125                          # Trailing context to grep
>          SNORTNAME='snort'               # Process name to look for
>
>          if [ ! -x "/sbin/pidof" ]; then
>             echo "/sbin/pidof not present, sorry, I cannot go on like this!"
>             exit 1
>          fi
>
>          #Grab Snort's PID
>          PID=`pidof -o $$ -o $PPID -o %PPID -x ${SNORTNAME}`
>
>          if [ ! -n "$PID" ]; then        # if we got no PID then:
>             echo "No PID found: ${SNORTNAME} must not running."
>             exit 2
>          fi
>
>          echo ""
>          echo "*******"
>          echo "WARNING:  This feature is EXPERIMENTAL - please report errors!"
>          echo "*******"
>          echo ""
>          echo "You can also run: $0 stats [long | opt]"
>          echo ""
>          echo "Dumping ${SNORTNAME}'s ($PID) statistics"
>          echo "please wait..."
>
>          # Get the date and tell Snort to dump stats as close together in
>          # time as possible--not 100%, but it seems to work.
>          startdate=`date '+%b %e %H:%M:%S'`
>
>          # This causes the stats to be dumped to syslog
>          kill -USR1 $PID
>
>          # Sleep for $SECS secs to give syslog a chance to catch up
>          # May need to be adjusted for slow/busy systems
>          sleep $SECS
>
>          if [ "$2" = "long" ]; then              # Long format
>              egrep -B 3 -A $TC "^$startdate .* snort.*: ={79}" $SYSLOG | \
>                  grep snort.*:
>          elif [ "$2" = "opt" ]; then             # OPTimize format
>             # Just show stuff useful for optimizing Snort
>              egrep -B 3 -A $TC "^$startdate .* snort.*: ={79}" $SYSLOG | \
>                  egrep "snort.*: Snort analyzed |snort.*: dropping|emory .aults:"
>          else                                    # Default format
>              egrep -B 3 -A $TC "^$startdate .* snort.*: ={79}" $SYSLOG | \
>                  grep snort.*: | cut -d: -f4-
>          fi
>          ;;
>    *)
>          echo "Usage: $0 {start|stop|reload|restart|condrestart|status|stats
> (long|opt)}"
>          exit 2
> esac
>
> exit 0
>
> 2012/11/8 Ray Caparros <arcy24 () gmail com <mailto:arcy24 () gmail com>>
>
>     Could you post your conf file for us to look at?
>
>     Thanks,
>     Ray
>
>     On Thu, Nov 8, 2012 at 1:54 PM, Leonardo Pezente <lmpezente () gmail com
>     <mailto:lmpezente () gmail com>> wrote:
>      > ok, i will try to be more clear.
>      > For what i can see, the snort has a startup script, and i only have to make
>      > some
>      > changes on it to adjust to my sistem. I have done that, but he is giving
>      > this error.
>      >
>      > im using ubuntu 12.04 LTS
>      >
>      > and im running snort with:
>      >
>      > snort -c /(path)/snort.conf
>      >
>      > for what i can see, this error happens because he cant find the file
>      > "functions".
>      > So i dont know if i jus comment this line or if there is another way.
>      >
>      > ---------- Forwarded message ----------
>      > From: waldo kitty <wkitty42 () windstream net <mailto:wkitty42 () windstream net>>
>      > Date: 2012/11/8
>      > Subject: Re: [Snort-users] error on startup
>      > To: Leonardo Pezente <lmpezente () gmail com <mailto:lmpezente () gmail com>>
>      >
>      >
>      >
>      > you need to send this to the list... i do not provide support in private...
>      > sorry... i guess i need to fix up a sig that states this :/
>      >
>      >
>      > On 11/8/2012 10:56, Leonardo Pezente wrote:
>      >>
>      >> ok, i will try to be more clear.
>      >> For what i can see, the snort has a startup script, and i only have to
>      >> make some
>      >> changes on it to adjust to my sistem. I have done that, but he is giving
>      >> this error.
>      >>
>      >> im using ubuntu 12.04 LTS
>      >>
>      >> and im running snort with:
>      >>
>      >> snort -c /(path)/snort.conf
>      >>
>      >> for what i can see, this error happens because he cant find the file
>      >> "functions".
>      >> So i dont know if i jus comment this line or if there is another way.
>      >>
>      >> 2012/11/7 waldo kitty <wkitty42 () windstream net
>     <mailto:wkitty42 () windstream net>
>      >> <mailto:wkitty42 () windstream net <mailto:wkitty42 () windstream net>>>
>      >>
>      >>
>      >>     On 11/7/2012 13:39, Leonardo Pezente wrote:
>      >> > im getting this error when i try to config the startup of snort
>      >> >
>      >> > ./snortd: 13: .: Can't open /etc/rc.d/init.d/functions
>      >> >
>      >> > For what i can see, the directory rc.d not even exist. Is there any
>      >> other
>      >>     file
>      >> > functions in another directory?
>      >>
>      >>     the crystal balls are all in the shop for failing performance
>      >> inspections...
>      >>     you've not given enough information and there's no way we can look
>      >> over your
>      >>     shoulder from half way around the world... without the crystal balls,
>      >> there's
>      >>     definitely no way we can help with the info you have provided...
>      >>
>      >>     with all that said...
>      >>
>      >>     1. what OS?
>      >>     2. what command are you using to try to start snort?

------------------------------------------------------------------------------
Everyone hates slow websites. So do we.
Make your web apps faster with AppDynamics
Download AppDynamics Lite for free today:
http://p.sf.net/sfu/appdyn_d2d_nov
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!