Re: [Prelude Hybrid IDS] #216: mod_security cleanup, and compatibility with version 2.0

#216: mod_security cleanup, and compatibility with version 2.0
-------------------------+--------------------------------------------------
 Reporter:  gegomez      |        Owner:  Peter Vrabec <[email protected]>
     Type:  defect       |       Status:  assigned                         
 Priority:  normal       |    Milestone:  Prelude-LML 0.9.13               
Component:  prelude-lml  |      Version:  0.9                              
 Severity:  normal       |   Resolution:                                   
 Keywords:               |  
-------------------------+--------------------------------------------------

Comment(by yoann):

 Replying to [comment:11 [email protected]]:
 > Replying to [comment:10 yoann]:
 > > Replying to [comment:7 [email protected]]:
 > > This is used for regression testing and reviewing generated alerts:
 > > {{{
 > >   cd prelude-lml/tests
 > >   ./loggrep.py ../plugins/pcre/ruleset/<name of your ruleset>.rules |
 ../src/prelude-lml --dry-run --metadata=nowrite,head --batch-mode --no-
 resolve --pcre --dump-unmatched --config ./prelude-lml.conf --text-output
 > > }}}
 >
 > I tested the ruleset "in action" (apache with modsec, prelude, prewikka)
 and it worked fine. However, I tried to test the ruleset using command you
 mentioned but it ends up with this error messages:
 >
 > {{{
 > $ ./loggrep.py modsecurity.rules | ../src/prelude-lml --dry-run
 --metadata=nowrite,head --batch-mode --no-resolve --pcre --dump-unmatched
 --config ./prelude-lml.conf --text-output
 > 01 Aug 15:44:51 (process:27226) ERROR: couldn't open config file
 /usr/local/etc/prelude-lml/plugins.rules. (regex.c:168 get_regex_table)

 The previous error are most probably due to the absence of plugin.rules:
 make sure prelude-lml is installed before running the tests.


 > {{{
 > $ pwd
 > /home/dkopecek/devel/prelude-lml/F-9/prelude-lml-0.9.12.2/tests
 > $ make tests
 > ./loggrep.py ../plugins/pcre/ruleset/*.rules | ../src/prelude-lml
 --quiet --dry-run --metadata=nowrite,head --batch-mode --no-resolve --pcre
 --dump-unmatched --config ./prelude-lml.conf 2>&1 | /bin/grep -Fvf ignored
 > grep: ignored: No such file or directory
 > Traceback (most recent call last):
 >   File "./loggrep.py", line 29, in <module>
 >     print i[:-1]
 > IOError: [Errno 32] Broken pipe
 > make: *** [tests] Error 2
 > }}}

 The file is missing, you can just ''touch ignored'' in order to fixes this
 problem.

-- 
Ticket URL: <https://trac.prelude-ids.org/ticket/216#comment:12>
Prelude Hybrid IDS <http://www.prelude-ids.org>
The Prelude Hybrid Intrusion Detection System suite
_______________________________________________
Prelude-devel site list
[email protected]
http://lists.prelude-ids.org/mailman/listinfo/prelude-devel