Re: [Snort-users] Startup Problem

--=-TvnNhSpakABKaVJl7TtU
Content-Type: text/plain
Content-Transfer-Encoding: quoted-printable

On Sun, 2004-04-04 at 02:32,
eric-dated-1083277626.193075aa63e273@catastrophe.net wrote:
> I'm having a startup problem here with snort..the error message I
> get is the following...
>=20
> Apr 3 12:12:16 pluto snort: FATAL ERROR:
> /var/snort/etc/snort.conf(34) =3D> Invalid configuration token
> 'server'. The first configuration must start with a 'global'
> configuration type.
>=20
> This is when I try to start snort with the following syntax.
>=20
> # /var/snort/bin/snort -c /var/snort/etc/snort.conf \
> -i em1 -Cbd -t /var/snort -l /var/snort/log/em1
>=20
[snip]
> include $RULE_PATH/local.rules
> include classification.config
> include reference.config

Just for the record (solved this over IRC): rules should be included at
the end of snort.conf, *after* classification.config, reference.config
and others.

Rule of thumb: rules are to be the last thing you include in snort.conf
(unless you *really* know what you are doing)

--=20
Michael Boman

--=-TvnNhSpakABKaVJl7TtU
Content-Type: application/pgp-signature; name=signature.asc
Content-Description: This is a digitally signed message part

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)

iD8DBQBAb3Tl1WsuM5gdL40RArzYAKCqflbcXSS0DaYVy4zK1K LzOY75YACdGBgL
RBRakhBrxvTAzoQVKbYlXBA=
=ACyj
-----END PGP SIGNATURE-----

--=-TvnNhSpakABKaVJl7TtU--



-------------------------------------------------------
This SF.Net email is sponsored by: IBM Linux Tutorials
Free Linux tutorial presented by Daniel Robbins, President and CEO of
GenToo technologies. Learn everything from fundamentals to system
administration.http://ads.osdn.com/?ad_id=1470&alloc_id=3638&op=click
_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/...fo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.p...st=snort-users