problems with prelude plugin for snort on nanobsd
jkv <[email protected]>
| Newsgroups | gmane.comp.security.ids.prelude.user |
|---|---|
| Message-ID | <[email protected]> |
Hi, Im having some problems getting the prelude library working for snort. Snort have been successfully compiled with prelude and i have the setup working on another box (virtual machine), but when i try the excact same setup om på nanobsd it dont work. The only difference as i see it is that on my nanobsd /var is a memory file system: # mount /dev/ad1s1a on / (ufs, local, read-only) devfs on /dev (devfs, local) /dev/md0 on /etc (ufs, local) /dev/md1 on /var (ufs, local) It seems like prelude is complaining about a lock file - but i cant seem to find the problem. Any ideas? The errors from snort/prelude: (with LIBPRELUDE_DEBUG=10) Rule application order: activation->dynamic->pass->drop->alert->log Log directory = /var/log/snort Verifying Preprocessor Configurations! 0 out of 512 flowbits in use. Decoding LoopBack on interface NULL 14 Oct 12:36:13 (process:3631) DEBUG: [init] thread used=1 (prelude-thread.c:335 _prelude_thread_in_use) 14 Oct 12:36:13 (process:3631) DEBUG: Using configuration file: /usr/local/etc/prelude/profile/snort/config. (prelude-option.c:261 process_cfg_file) 14 Oct 12:36:13 (process:3631) DEBUG: Using configuration file: /usr/local/etc/prelude/default/global.conf. (prelude-option.c:261 process_cfg_file) 14 Oct 12:36:13 (process:3631) DEBUG: [queue=0xbfbfe1ec] prelude() (prelude-option.c:329 call_option_cb) 14 Oct 12:36:13 (process:3631) DEBUG: Using configuration file: /usr/local/etc/prelude/default/client.conf. (prelude-option.c:261 process_cfg_file) 14 Oct 12:36:13 (process:3631) DEBUG: [queue=0xbfbfe1ec] prelude() (prelude-option.c:329 call_option_cb) 14 Oct 12:36:13 (process:3631) DEBUG: [queue=0x288f7490] server-addr(10.0.0.10) (prelude-option.c:329 call_option_cb) 14 Oct 12:36:13 (process:3631) DEBUG: prelude() context=0x286490e0 default=0x286490e0 (prelude-option.c:385 call_option_from_cb_list) 14 Oct 12:36:13 (process:3631) DEBUG: prelude() context=0x286490e0 default=0x286490e0 (prelude-option.c:385 call_option_from_cb_list) 14 Oct 12:36:13 (process:3631) DEBUG: server-addr(10.0.0.10) context=0x286490e0 default=0x286490e0 (prelude-option.c:385 call_option_from_cb_list) 14 Oct 12:36:13 (process:3631) DEBUG: woke up 0 timer (prelude-timer.c:149 walk_and_wake_up_timer) ERROR: prelude-failover: Unable to initialize prelude client: error locking '/var/spool/prelude/snort/global/data0': Invalid argument. Fatal Error, Quitting.. _______________________________________________ Prelude-user site list [email protected] http://lists.prelude-ids.org/mailman/listinfo/prelude-user