Errors loading compiled rules

Hi snort community,
=A0
I'm looking for some help with a problem with which I have been struggling
for days now. I'm using snort3 v 3.1.18.0 and working on Ubuntu 20.04.5 LTS,
but also have the same problem on 22.04.5 LTS. I can see a thread in the
archive relating to something similar in 2021, but I can't see a solution
that I can make work, hence me reaching out.
=A0
When I Use pulledpork to download the latest registered rule set, several
(34 on last run) .so rules files (browser-chrome.so etc) are written into
the directory defined in sorule_path in the pulledpork.conf file; in my case
this is /usr/local/etc/rules/so_rules.
=A0
However, when I run the command =

snort -c /usr/local/etc/snort/snort.lua --plugin-path
/usr/local/etc/rules/so_rules/ =

I receive 3250 errors, one associated with each of the compiled rule entries
in pulledpork.rules.
=A0
Example:
ERROR: ../rules/pulledpork.rules:22830 SO rule 64088 not loaded.
=A0
My plugin-path option is definitely pointing at the directory where I can
see the .so files that were created when I ran pulledpork.
=A0
I cannot immediately see how the SO rules defined in pulledpork.conf map to
the .so files. It feels like I have missed a step somewhere but can't figure
out where. Can anybody advise me? =

=A0
Many thanks,
Mike


_______________________________________________
Snort-users mailing list
[email protected]
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

	To unsubscribe, send an email to:
	[email protected]

Please visit http://blog.snort.org to stay current on all the latest Snort =
news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-e=
tiquette