RE: FW: unknown alert format
"Jim Grossl" <[email protected]> Tue, 3 Jun 2003 12:22:36 -0600
| Newsgroups | gmane.comp.security.ids.snort.snarf |
|---|---|
| Message-ID | <[email protected]> |
This is a multi-part message in MIME format. ------=_NextPart_000_0018_01C329CA.D19D5EB0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Hi Bill, I've seen the "unknown alert format" error after cutting and pasting the alert.ids file while Snort was running. If you look at the file the log entries are corrupt. The array references can be fixed by using Active Perl 5.6. At least this fixed it for me. Good luck. -----Original Message----- From: [email protected] [mailto:[email protected]] On Behalf Of Bill Young Sent: Tuesday, June 03, 2003 12:10 PM To: [email protected] Subject: [Snortsnarf] FW: unknown alert format Howdy, I am having a issue installing/running SnortSnarf-021111.1 on Windows and parsing Snort 2.0 log files. When I run SnortSnarf I get the following error as it looks through the log. ------------------------------------------------------ unknown alert format for line: :56464 ; skipping unknown alert format for line: :56464 ; skipping ------------------------------------------- I am also getting the following error when starting SnortSnarf but it appears not to interfere with the actual parsing of the files. ----------------------------------------------------- Using an array as a reference is deprecated at include/SnortSnarf/HTMLMemStorage.pm line 290. Using an array as a reference is deprecated at include/SnortSnarf/HTMLAnomMemStorage.pm line 266. -------------------------------------------------------- Looking back through the archives I noticed that there was an issue with the previous version of SnortSnarf and Snort 1.9 last October. Just wondering if anyone has seen this on Snort 2.0 and if there is a possible work around. Thanks and appreciate any help, Bill ------=_NextPart_000_0018_01C329CA.D19D5EB0 Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <HTML><HEAD> <META HTTP-EQUIV=3D"Content-Type" CONTENT=3D"text/html; = charset=3Dus-ascii"> <TITLE>Message</TITLE> <META content=3D"MSHTML 6.00.2800.1170" name=3DGENERATOR></HEAD> <BODY> <DIV><SPAN class=3D367271718-03062003><FONT face=3DArial color=3D#0000ff = size=3D2>Hi=20 Bill, I've seen the "unknown alert format" error after cutting and = pasting the=20 alert.ids file</FONT></SPAN></DIV> <DIV><SPAN class=3D367271718-03062003><FONT face=3DArial color=3D#0000ff = size=3D2>while=20 Snort was running. If you look at the file the log entries are=20 corrupt.</FONT></SPAN></DIV> <DIV><SPAN class=3D367271718-03062003><FONT face=3DArial color=3D#0000ff = size=3D2></FONT></SPAN> </DIV> <DIV><SPAN class=3D367271718-03062003><FONT face=3DArial color=3D#0000ff = size=3D2>The=20 array references can be fixed by using Active Perl 5.6. At = </FONT></SPAN><SPAN=20 class=3D367271718-03062003><FONT face=3DArial color=3D#0000ff = size=3D2>least this=20 fixed it for me.</FONT></SPAN></DIV> <DIV><SPAN class=3D367271718-03062003><FONT face=3DArial color=3D#0000ff = size=3D2></FONT></SPAN> </DIV> <DIV><SPAN class=3D367271718-03062003><FONT face=3DArial color=3D#0000ff = size=3D2>Good=20 luck.</FONT></SPAN></DIV> <BLOCKQUOTE dir=3Dltr style=3D"MARGIN-RIGHT: 0px"> <DIV></DIV> <DIV class=3DOutlookMessageHeader lang=3Den-us dir=3Dltr = align=3Dleft><FONT=20 face=3DTahoma size=3D2>-----Original Message-----<BR><B>From:</B>=20 [email protected]=20 [mailto:[email protected]] <B>On Behalf Of = </B>Bill=20 Young<BR><B>Sent:</B> Tuesday, June 03, 2003 12:10 PM<BR><B>To:</B>=20 [email protected]<BR><B>Subject:</B> [Snortsnarf] = FW:=20 unknown alert format<BR><BR></FONT></DIV> <DIV> <DIV class=3DOutlookMessageHeader lang=3Den-us dir=3Dltr = align=3Dleft><FONT=20 face=3DTahoma size=3D2></FONT></DIV><FONT face=3DArial size=3D2><SPAN=20 class=3D804490017-03062003>Howdy,</SPAN></FONT></DIV> <DIV><FONT face=3DArial size=3D2><SPAN class=3D804490017-03062003>I am = having a=20 issue installing/running SnortSnarf-021111.1 on Windows and parsing = Snort 2.0=20 log files. When I run SnortSnarf I get the following error as it = looks=20 through the log.</SPAN></FONT></DIV> <DIV><FONT face=3DArial size=3D2></FONT> </DIV> <DIV><FONT face=3DArial size=3D2><SPAN=20 = class=3D804490017-03062003>----------------------------------------------= --------</SPAN></FONT></DIV><!-- Converted from text/rtf format --> <P><SPAN lang=3Den-us><FONT face=3D"Palatino Linotype" = size=3D2>unknown alert format=20 for line: :56464<BR>; skipping<BR>unknown alert format for line: = :56464<BR>;=20 skipping</FONT></SPAN></P> <P><SPAN lang=3Den-us><SPAN class=3D804490017-03062003><FONT=20 face=3D"Palatino Linotype"=20 = size=3D2>-------------------------------------------</FONT></SPAN></SPAN>= </P> <P><SPAN lang=3Den-us><SPAN class=3D804490017-03062003><FONT = face=3DArial size=3D2>I=20 am also getting the following error when starting SnortSnarf but it = appears=20 not to interfere with the actual parsing of the=20 files.</FONT></SPAN></SPAN></P> <P><SPAN lang=3Den-us><SPAN class=3D804490017-03062003><FONT = face=3DArial=20 = size=3D2>-----------------------------------------------------</FONT></SP= AN></SPAN></P> <P><SPAN lang=3Den-us><SPAN class=3D804490017-03062003><FONT = face=3DArial=20 size=3D2>Using an array as a reference is deprecated at=20 include/SnortSnarf/HTMLMemStorage.pm line 290.<BR>Using an array as a=20 reference is deprecated at include/SnortSnarf/HTMLAnomMemStorage.pm = line=20 266.</FONT></SPAN></SPAN></P> <P><SPAN lang=3Den-us><SPAN class=3D804490017-03062003><FONT = face=3DArial=20 = size=3D2>--------------------------------------------------------</FONT><= /SPAN></SPAN></P> <P><SPAN lang=3Den-us><SPAN class=3D804490017-03062003><FONT = face=3DArial=20 size=3D2>Looking back through the archives I noticed that there = was an=20 issue with the previous version of SnortSnarf and Snort 1.9 last=20 October. Just wondering if anyone has seen this on Snort 2.0 and = if=20 there is a possible work around. </FONT></SPAN></SPAN></P> <P><SPAN lang=3Den-us><SPAN class=3D804490017-03062003><FONT = face=3DArial=20 size=3D2>Thanks and appreciate any help,</FONT></SPAN></SPAN></P> <P><SPAN lang=3Den-us><SPAN class=3D804490017-03062003><FONT = face=3DArial=20 size=3D2>Bill</FONT></SPAN></SPAN></P></BLOCKQUOTE></BODY></HTML> ------=_NextPart_000_0018_01C329CA.D19D5EB0--