Re: Unknown ClassType: sdf

["Al Lewis (allewi)" <allewi () cisco com>]

What is the variable “$PREPROC_RULE_PATH” defined as?

Can you send us a copy of the conf file?

Albert Lewis
QA Software Engineer
SOURCEfire, Inc. now part of Cisco
9780 Patuxent Woods Drive
Columbia, MD 21046
Phone: (office) 443.430.7112
Email: allewi () cisco com

From: Andrew Shagayev [mailto:drewshg () gmail com]
Sent: Saturday, April 04, 2015 1:08 AM
To: snort-users () lists sourceforge net
Subject: [Snort-users] Unknown ClassType: sdf

Hi everyone!

OS X 10.10.2
Snort 2.9.7.2 GRE (Build 177)
when running snort, getting this:
…
Initializing rule chains...
ERROR: /usr/local/etc/snort/preproc_rules/preprocessor.rules(215) Unknown ClassType: sdf
Fatal Error, Quitting..

I have 'include classification.config' in my snort.conf and 'config classification: sdf,Senstive Data,2'
Snort starts if only I comment these lines in snort.conf:

include $PREPROC_RULE_PATH/preprocessor.rules
include $PREPROC_RULE_PATH/sensitive-data.rules

Any ideas? Would appreciate any help!

--
A.S.

------------------------------------------------------------------------------
Dive into the World of Parallel Programming The Go Parallel Website, sponsored
by Intel and developed in partnership with Slashdot Media, is your hub for all
things parallel software development, from weekly thought leadership blogs to
news, videos, case studies, tutorials and more. Take a look and join the 
conversation now. http://goparallel.sourceforge.net/

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!