I had similar problem with snort on RH6.2 - turns out I had to specify the
hard path in the conf file to point to the rules:

include /etc/snort/local.rules

I had to do this for all the rules. Just an idea...

-----------------------------------
Aaron McKinnon
System Administrator
Fullerene Productions, Inc.
3250 Wilshire Blvd. Suite 2000
Los Angeles, CA 90010
213.365.1692
-----------------------------------

-----Original Message-----
From: snort-users-adminlists.sourceforge.net
[mailto:snort-users-adminlists.sourceforge.net]On Behalf Of Colin Wu
Sent: Friday, June 08, 2001 9:32 AM
To: Snort Users
Subject: [Snort-users] Error: unable to open local.rules

I periodically HUP my snort (v1.7) to checkpoint the binary dump log,
but occasionally snort will die with the message: " ERROR: Unable to
open rules file: local.rules" in syslog. At this point I have to rename
the local.rules file and make a new copy (mv local.rules local; cp local
local.rules).

Any ideas?

--
   __     _             _            Network Analyst
  /  )   //            ' )   /       Computing & Information Services
 /    __|/  o ____      / / / . .    McMaster University
(__/ (_) \_<_/ / <_    (_(_/ (_/_    (905)525-9140 ext 24050
                                     http://netman.McMaster.CA
_______________________________________________
Snort-users mailing list
Snort-userslists.sourceforge.net
Go to this URL to change user options or unsubscribe:
http://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users
_______________________________________________
Snort-users mailing list
Snort-userslists.sourceforge.net
Go to this URL to change user options or unsubscribe:
http://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]