Lua rules

J. Ignacio Ormeño <[email protected]>
Newsgroups gmane.comp.security.ids.prelude.user
Message-ID <[email protected]>
Hello,

I'm starting to work in deepth with Prelude-correlator capabilities and I am
trying to develop some correlation rules using LUA.

The problem is the following, when I try to run prelude-correlator using a
custom rule:

$cat my_rule.lua

print("*** Any global initialization code goes here")
local socket = require("socket")

function my_rule(INPUT)
     print ("*** This function is going to be called when Prelude-Correlator
receive and IDMEF message");
    print(socket._VERSION)
end

Prelude-correlator dies with the following output:

# prelude-correlator
*** Any global initialization code goes here
05 Jun 13:04:29 (process:32375) ERROR: LUA error: error loading module
'socket.core' from file '/usr/lib/lua/5.1/socket/core.so':
 /usr/lib/lua/5.1/socket/core.so: undefined symbol: lua_getmetatable.
(lua.c:186 set_lua_ruleset)
05 Jun 13:04:29 (process:32375) WARNING: error while setting option
'rulesdir'.

However if I try to run my_rule script with lua interpreter, output is:

lua -i my_rule.lua
Lua 5.1.2  Copyright (C) 1994-2007 Lua.org, PUC-Rio
*** Any global initialization code goes here
> my_rule(INPUT);
*** This function is going to be called when Prelude-Correlator receive and
IDMEF message
LuaSocket 2.0.2

Any ideas?

Thank's for all

Nacho

---------------------
Additional data:

Prelude-correlator-0.9.0-beta3
Ubuntu 8.04
Lua 5.1
luasocket-2.0.2
LUA_CPATH=?.so;/usr/lib/lua/5.1/?.so
LUA_PATH=?.lua;/usr/lib/lua/5.1/?.lua;/usr/share/lua/5.1/?.lua
_______________________________________________
Prelude-user site list
[email protected]
http://lists.prelude-ids.org/mailman/listinfo/prelude-user
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.