Re: so_rules are not processed by pulledpork underFreeBSD 9.1

["Seth Dunn" <seth () d2ms com>]

Ok, so /so_rules/ is present
What about /rules/
Cause it appears that it is trying to work within that directory. 
/data/config/etc/idpsnort01/rules/

-----Original Message-----
From: C. L. Martinez [mailto:carlopmart () gmail com] 
Sent: Thursday, May 09, 2013 9:59 AM
To: Seth Dunn
Cc: snort-users () lists sourceforge net
Subject: Re: [Snort-users] so_rules are not processed by pulledpork underFreeBSD 9.1

On Thu, May 9, 2013 at 1:52 PM, Seth Dunn <seth () d2ms com> wrote:
> One other thing to look at:
>         Snort Config File: /data/config/etc/idpsnort01/snort.conf
>         Snort Path is: /usr/local/bin/snort
>         SO Output Path is: /data/config/etc/idpsnort01/so_rules/
>
> And your error shows::
> An error occurred: ERROR:
> /data/config/etc/idpsnort01/rules/VRT-app-detect.rules(0) Unable to 
> open rules file
> "/data/config/etc/idpsnort01/rules/VRT-app-detect.rules": No such file 
> or directory.
>
> Is there a /rules/ or /so_rules/ folder in which PP is working with?

/so_rules/ directory configured under pulledpork.conf, exists:

root@plzfnsm01:/tmp# ls -la /data/config/etc/idpsnort01/so_rules
total 8
drwxr-xr-x  2 root  wheel  512 May  9 06:03 .
drwxr-xr-x  5 root  wheel  512 May  9 13:55 ..

but, pulledpork is working under:

Generating Stub Rules....
        Generating shared object stubs via:/usr/local/bin/snort -c /data/config/etc/idpsnort01/snort.conf
--dump-dynamic-rules=/tmp/tha_rules/so_rules/
        An error occurred:

 ... and I don't understand why ...
------------------------------------------------------------------------------
Learn Graph Databases - Download FREE O'Reilly Book
"Graph Databases" is the definitive new guide to graph databases and 
their applications. This 200-page book is written by three acclaimed 
leaders in the field. The early access version is available now. 
Download your free book today! http://p.sf.net/sfu/neotech_d2d_may
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!