Re: why does "config disable_decode_alerts" give me "Missing argument to RULE_PATH"?

Hello,


If this is a slash at the end you need a backslash on windows,

I hope your success,

Thanks you in advance for your answer,

Regards.


Dorian Rosse.
________________________________
From: [email protected] <[email protected]>
Sent: Monday, May 30, 2022 8:23:32 PM
To: 'Dorian ROSSE' <[email protected]>
Subject: RE: [Snort-users] why does "config disable_decode_alerts" give me "Missing argument to RULE_PATH"?


Hi Dorian.

Since I am using windows, I had to make sure I took off the ending slash

from this
var $RULE_PATH D:\NetworkMonitoringToolsSnort\Snort\rules\

to this

var $RULE_PATH D:\NetworkMonitoringToolsSnort\Snort\rules



getting new errors now further down the snort.conf page. So, slash change helped.
will post this news error separately .



thanks again!



From: Dorian ROSSE <[email protected]>
Sent: Friday, May 27, 2022 10:52 AM
To: [email protected]; [email protected]
Subject: Re: [Snort-users] why does "config disable_decode_alerts" give me "Missing argument to RULE_PATH"?



You have created the folder yesterday when I was advice to did,



What error happen your snort now ?



I hope your success,



Thanks you in advance for your answer,



Regards.





Dorian Rosse.

________________________________

From: [email protected]<mailto:[email protected]> <[email protected]<mailto:[email protected]>>
Sent: Friday, May 27, 2022 4:26:00 PM
To: 'Dorian ROSSE' <[email protected]<mailto:[email protected]>>
Subject: RE: [Snort-users] why does "config disable_decode_alerts" give me "Missing argument to RULE_PATH"?



Sounds interesting but I don’t understand. Could you clarify? Where did you the rules folder missing? Here is another attachment that shows the main snort folder under “NetworkMonitoringToolsSnort”.



From: Dorian ROSSE <[email protected]<mailto:[email protected]>>
Sent: Thursday, May 26, 2022 11:38 PM
To: [email protected]<mailto:[email protected]>; [email protected]<mailto:[email protected]>
Subject: Re: [Snort-users] why does "config disable_decode_alerts" give me "Missing argument to RULE_PATH"?



Hello,





Does the rules folder was missing thus you go more far with snort ?



I hope your success,



Thanks you in advance for your answer,



Regards.





Dorian Rosse.

________________________________

From: [email protected]<mailto:[email protected]> <[email protected]<mailto:[email protected]>>
Sent: Thursday, May 26, 2022 11:25:20 PM
To: 'Dorian ROSSE' <[email protected]<mailto:[email protected]>>
Subject: RE: [Snort-users] why does "config disable_decode_alerts" give me "Missing argument to RULE_PATH"?



Here is the path. I will keep working on  it. here is an attachment.



From: Dorian ROSSE <[email protected]<mailto:[email protected]>>
Sent: Thursday, May 26, 2022 1:39 PM
To: [email protected]<mailto:[email protected]>; [email protected]<mailto:[email protected]>
Subject: Re: [Snort-users] why does "config disable_decode_alerts" give me "Missing argument to RULE_PATH"?



That you can check is if the rules directory is created at the end of your path,



I hope your success,



Thanks you in advance for your answer,



Regards.





Dorian Rosse.

________________________________

From: [email protected]<mailto:[email protected]> <[email protected]<mailto:[email protected]>>
Sent: Thursday, May 26, 2022 9:52:32 PM
To: 'Dorian ROSSE' <[email protected]<mailto:[email protected]>>
Subject: RE: [Snort-users] why does "config disable_decode_alerts" give me "Missing argument to RULE_PATH"?



Ok thanks



From: Dorian ROSSE <[email protected]<mailto:[email protected]>>
Sent: Thursday, May 26, 2022 12:50 PM
To: [email protected]<mailto:[email protected]>
Subject: Re: [Snort-users] why does "config disable_decode_alerts" give me "Missing argument to RULE_PATH"?



Sorry I don't understand what do now,



Regards.





Dorian Rosse.

________________________________

From: [email protected]<mailto:[email protected]> <[email protected]<mailto:[email protected]>>
Sent: Thursday, May 26, 2022 9:05:49 PM
To: 'Dorian ROSSE' <[email protected]<mailto:[email protected]>>
Subject: RE: [Snort-users] why does "config disable_decode_alerts" give me "Missing argument to RULE_PATH"?



Hi Dorian, thanks for the info. I created a new snort folder and path to eliminate spaces.

D:\NetworkMonitoringToolsSnort\Snort\



I also changed these

#var RULE_PATH D:\NetworkMonitoringToolsSnort\Snort\rules\

var $RULE_PATH D:\NetworkMonitoringToolsSnort\Snort\rules\

# SO_RULE_PATH ../so_rules

var $PREPROC_RULE_PATH D:\NetworkMonitoringToolsSnort\Snort\preproc_rules\



attached is the snort.conf that changed (I copied the snort.conf that I got when I downloaded snort and made your changes there).



Here are the results – it stopped at the same place –

# Stop generic decode events:

Line 122 - config disable_decode_alerts



D:\NetworkMonitoringToolsSnort\Snort\bin>Snort -i 1 -c  "D:\NetworkMonitoringToolsSnort\Snort\etc\snort.conf" -T

Running in Test mode



        --== Initializing Snort ==--

Initializing Output Plugins!

Initializing Preprocessors!

Initializing Plug-ins!

Parsing Rules file "D:\NetworkMonitoringToolsSnort\Snort\etc\snort.conf"

PortVar 'HTTP_PORTS' defined :  [ 80:81 311 383 591 593 901 1220 1414 1741 1830 2301 2381 2809 3037 3128 3702 4343 4848 5250 6988 7000:7001 7144:7145 7510 7777 7779 8000 8008 8014 8028 8080 8085 8088 8090 8118 8123 8180:8181 8243 8280 8300 8800 8888 8899 9000 9060 9080 9090:9091 9443 9999 11371 34443:34444 41080 50002 55555 ]

PortVar 'SHELLCODE_PORTS' defined :  [ 0:79 81:65535 ]

PortVar 'ORACLE_PORTS' defined :  [ 1024:65535 ]

PortVar 'SSH_PORTS' defined :  [ 22 ]

PortVar 'FTP_PORTS' defined :  [ 21 2100 3535 ]

PortVar 'SIP_PORTS' defined :  [ 5060:5061 5600 ]

PortVar 'FILE_DATA_PORTS' defined :  [ 80:81 110 143 311 383 591 593 901 1220 1414 1741 1830 2301 2381 2809 3037 3128 3702 4343 4848 5250 6988 7000:7001 7144:7145 7510 7777 7779 8000 8008 8014 8028 8080 8085 8088 8090 8118 8123 8180:8181 8243 8280 8300 8800 8888 8899 9000 9060 9080 9090:9091 9443 9999 11371 34443:34444 41080 50002 55555 ]

PortVar 'GTP_PORTS' defined :  [ 2123 2152 3386 ]

ERROR: D:\NetworkMonitoringToolsSnort\Snort\etc\snort.conf(122) Missing argument to $RULE_PATH

Fatal Error, Quitting..

Could not set the event message file.

D:\NetworkMonitoringToolsSnort\Snort\bin>





Again, thanks for your help



From: Snort-users <[email protected]<mailto:[email protected]>> On Behalf Of Dorian ROSSE via Snort-users
Sent: Thursday, May 26, 2022 6:01 AM
To: [email protected]<mailto:[email protected]>
Subject: [Snort-users] why does "config disable_decode_alerts" give me "Missing argument to RULE_PATH"?



Hello,





You should lay one sharp in front of the bad line where the dollar is missing :



#var RULE_PATH  D:\Network Monitoring Tools\Snort2022\Snort\rules\

var $RULE_PATH  D:\Network Monitoring Tools\Snort2022\Snort\rules\



does this path is where are located yours rules downloaded ? :



D:\Network Monitoring Tools\Snort2022\Snort\rules\



If your path for the preproc rules is good you can lay the dollar in front of this line :



var $PREPROC_RULE_PATH D:\Network Monitoring Tools\Snort2022\Snort\preproc_rules\



I hope your success,



Regards.





Dorian Rosse.

_______________________________________________
Snort-users mailing list
[email protected]
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

	To unsubscribe, send an email to:
	[email protected]

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette