Hyperscan and ERROR: rules/snort.rules:3208 can't compile content ''

Hello,

I am using Arch Linux with snort version as follows:

   ,,_     -*> Snort++ <*-
   o"  )~   Version 3.1.63.0
    ''''    By Martin Roesch & The Snort Team
            http://snort.org/contact#team
            Copyright (C) 2014-2023 Cisco and/or its affiliates. All 
rights reserved.
            Copyright (C) 1998-2013 Sourcefire, Inc., et al.
            Using DAQ version 3.0.11
            Using LuaJIT version 2.1.0-beta3
            Using OpenSSL 3.1.1 30 May 2023
            Using libpcap version 1.10.4 (with TPACKET_V3)
            Using PCRE version 8.45 2021-06-15
            Using ZLIB version 1.2.13
            Using Hyperscan version 5.4.2 2023-04-22
            Using LZMA version 5.4.3

I am running it on Intel i3-9100T CPU (Dell Optiplex 3070)

But there are hundreds of lines as follows:

ERROR: rules/snort.rules:3208 can't compile content ''

Snort crashes with following error:
Jun 20 09:36:34 foo snort[27985]: FATAL ERROR: see prior 721 errors (0 
warnings)

But this same version (with exact same package file) works fine on an 
older machine with Intel Core 2 Duo. Both machines have identical 
packages installed.

I have following line in local.lua file

-- Enable hyperscan for IPS, AppID, HTTP inspection, pcre/regex matches
search_engine = { search_method = "hyperscan" }
detection = { hyperscan_literals = true, pcre_to_regex = true }

With this line it works fine on Intel Core 2 Duo machine but not work on 
Intel i3-9100T.

If I comment above two config lines, then snort starts fine.

What could be the issue? And how can I solve this?

Thank you

Amish.

_______________________________________________
Snort-users mailing list
[email protected]
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

	To unsubscribe, send an email to:
	[email protected]

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette