<div dir="ltr">Hello,<br><br>I&#39;ve addedd the  2.8.5.3 rules<br>But still these errors !!!<br><br>  <font size="1">[6521] 16/6/2010 -- 14:52:10 - (detect-bytetest.c:538) &lt;Error&gt; (DetectBytetestSetup) -- [ERRCODE: SC_ERR_BYTETEST_MISSING_CONTENT(104)] - relative bytetest match needs a previous content option<br>
[6521] 16/6/2010 -- 14:52:10 - (detect.c:297) &lt;Error&gt; (DetectLoadSigFile) -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(37)] - Error parsing signature &quot;alert tcp $EXTERNAL_NET any -&gt; $HTTP_SERVERS $HTTP_PORTS (msg:&quot;WEB-MISC client negative Content-Length attempt&quot;; flow:to_server,established; content:&quot;Content-Length|3A|&quot;; nocase; http_header; byte_test:4,&gt;,0x7FFFFFFF,0,relative,string,dec; metadata:policy balanced-ips drop, policy security-ips drop, service http; reference:bugtraq,17879; reference:bugtraq,9098; reference:bugtraq,9476; reference:bugtraq,9576; reference:cve,2004-0095; reference:cve,2006-2162; classtype:misc-attack; sid:2278; rev:15;)&quot; from file /etc/suricata/rules/web-misc.rules at line 366<br>
[6521] 16/6/2010 -- 14:52:10 - (detect-http-method.c:180) &lt;Error&gt; (DetectHttpMethodSetup) -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(37)] - http_method cannot be used with &quot;fast_pattern&quot;<br>[6521] 16/6/2010 -- 14:52:10 - (detect.c:297) &lt;Error&gt; (DetectLoadSigFile) -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(37)] - Error parsing signature &quot;alert tcp $EXTERNAL_NET any -&gt; $HOME_NET $HTTP_PORTS (msg:&quot;WEB-MISC Sun Java System Web Server 7.0 WebDAV format string exploit attempt - LOCK method&quot;; flow:to_server,established; content:&quot;LOCK&quot;; fast_pattern; nocase; http_method; content:&quot;encoding&quot;; pcre:&quot;/\&lt;\?xml[^\&gt;]+encoding\s*\=\s*(\&#39;|\&quot;)[^\&#39;\&quot;\&gt;\%]*\%/&quot;; metadata:policy balanced-ips drop, policy security-ips drop, service http; reference:bugtraq,37910; reference:cve,2010-0388; classtype:attempted-user; sid:16427; rev:1;)&quot; from file /etc/suricata/rules/web-misc.rules at line 555<br>
[6521] 16/6/2010 -- 14:52:12 - (detect.c:341) &lt;Error&gt; (SigLoadSignatures) -- [ERRCODE: SC_ERR_NO_RULES(40)] - No rules loaded from /etc/suricata/rules/emerging-web.rules<br>[6521] 16/6/2010 -- 14:52:19 - (detect.c:382) &lt;Info&gt; (SigLoadSignatures) -- 71 rule files processed. 11678 rules succesfully loaded, 482 rules failed<br>
</font><br>The rules are loaded or not ?<br><br>Thanks to you<br></div>