<html><head><meta http-equiv="Content-Type" content="text/html charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">from config file:<div><br></div><div># Set the default rule path here to search for the files. <br># if not set, it will look at the current working dir <br>default-rule-path: /home/sensors/test1/Rules<br>rule-files:<br> -local.rules<br> -snort.rules<br><br></div><div>sensors@secmontst01:~$ ls -l /home/sensors/test1/Rules<br>total 9928<br>-rw-r--r-- 1 sensors sensors 1743 Jul 17 23:34 local.rules<br>-rw-rw-r-- 1 sensors sensors 344168 Jul 28 10:04 sid-msg.map<br>-rw-rw-r-- 1 sensors sensors 8702533 Jul 18 00:40 snort-full.rules<br>-rw-r--r-- 1 sensors sensors 1099184 Jul 28 10:04 snort.rules<br>-rw-rw-r-- 1 sensors sensors 4553 Aug 18 09:47 threshold.conf<br><br></div><div>and when I start suricata I get:</div><div><br></div><div>Initialization syslog logging with format "[%i] <%d> -- ".</div><div>18/8/2013 -- 09:48:04 - <Info> - allocated 229376 bytes of memory for the defrag hash... 4096 buckets of size 56<br>18/8/2013 -- 09:48:04 - <Info> - preallocated 1000 defrag trackers of size 144<br>18/8/2013 -- 09:48:04 - <Info> - defrag memory usage: 373376 bytes, maximum: 16777216<br>18/8/2013 -- 09:48:04 - <Info> - AutoFP mode using default "Active Packets" flow load balancer<br>18/8/2013 -- 09:48:04 - <Info> - preallocated 1024 packets. Total memory 4362240<br>18/8/2013 -- 09:48:04 - <Info> - allocated 229376 bytes of memory for the host hash... 4096 buckets of size 56<br>18/8/2013 -- 09:48:04 - <Info> - preallocated 1000 hosts of size 120<br>18/8/2013 -- 09:48:04 - <Info> - host memory usage: 349376 bytes, maximum: 16777216<br>18/8/2013 -- 09:48:04 - <Info> - allocated 3670016 bytes of memory for the flow hash... 65536 buckets of size 56<br>18/8/2013 -- 09:48:04 - <Info> - preallocated 10000 flows of size 272<br>18/8/2013 -- 09:48:04 - <Info> - flow memory usage: 6390016 bytes, maximum: 33554432<br>18/8/2013 -- 09:48:04 - <Info> - IP reputation disabled<br>18/8/2013 -- 09:48:04 - <Info> - Delayed detect disabled<br><font color="#ff2600">18/8/2013 -- 09:48:04 - <Info> - No signatures supplied.</font><br>18/8/2013 -- 09:48:04 - <Info> - Threshold config parsed: 14 rule(s) found<br>18/8/2013 -- 09:48:04 - <Info> - dropped the caps for main thread<br>18/8/2013 -- 09:48:04 - <Info> - fast output device (regular) initialized: fast.log<br>18/8/2013 -- 09:48:04 - <Info> - Unified2-alert initialized: filename unified2.alert, limit 32 MB<br>18/8/2013 -- 09:48:04 - <Info> - http-log output device (regular) initialized: http.log<br>18/8/2013 -- 09:48:04 - <Info> - Using 1.0 style configuration for pfring<br>18/8/2013 -- 09:48:04 - <Info> - Using round-robin cluster mode for PF_RING (iface eth2)<br>18/8/2013 -- 09:48:04 - <Info> - Going to use 1 ReceivePfring receive thread(s)<br>18/8/2013 -- 09:48:04 - <Info> - (RxPFR1) Using PF_RING v.5.5.3, interface eth2, cluster-id 99, single-pfring-thread</div><div><br></div><div>I know this was working at one time! Clearly I have broken something :(</div><div><br></div><div><br><br></div></body></html>