<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body text="#000000" bgcolor="#FFFFFF">
Duane - The only logic I can think of for fatally exiting on loading
an empty rules file would be to prevent a user from accidentally
wiping out all their rules (bad VI save command, bad 'cat' redirec,
etc) and then proceeding to rely on an emtpy IDS to protect them.<br>
<br>
<br>
<div class="moz-cite-prefix">On 09/18/2013 10:10 AM, Duane Howard
wrote:<br>
</div>
<blockquote
cite="mid:CAH9u3cug3cmWgvZY7aO0wyC24kBGje4rj7qgXcE_qg0DX9Nkmg@mail.gmail.com"
type="cite">
<div dir="ltr">Hey folks,
<div><br>
</div>
<div>I keep an empty rules file on my snort boxes for use with
short lived or temporary rules. Snort seems to be alright with
loading an empty rules file, but when I try to do the same on
Suricata it complains with an Warning and exits.</div>
<div><br>
</div>
<div>me@mybox:~$suricata -T -l /tmp -c
/etc/suricata/suricata.yaml<br>
</div>
<div><snip></div>
<div>18/9/2013 -- 17:01:38 - <Warning> - [ERRCODE:
SC_ERR_NO_RULES(42)] - No rules loaded from
/etc/suricata/rules/temp.rules<br>
</div>
<div><br>
</div>
<div>Shouldn't a warning message be non-fatal? Why is attempting
to load an empty file bad?</div>
<div>The primary reason I do this is so that I don't need to
change my suricata.yaml config when swapping in and out these
temporary rules.</div>
<div><br>
</div>
<div>Currently on 1.4.2 RELEASE if that matters.</div>
<div><br>
</div>
<div>Thanks!</div>
<div>./d</div>
</div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
Suricata IDS Users mailing list: <a class="moz-txt-link-abbreviated" href="mailto:oisf-users@openinfosecfoundation.org">oisf-users@openinfosecfoundation.org</a>
Site: <a class="moz-txt-link-freetext" href="http://suricata-ids.org">http://suricata-ids.org</a> | Support: <a class="moz-txt-link-freetext" href="http://suricata-ids.org/support/">http://suricata-ids.org/support/</a>
List: <a class="moz-txt-link-freetext" href="https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users">https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users</a>
OISF: <a class="moz-txt-link-freetext" href="http://www.openinfosecfoundation.org/">http://www.openinfosecfoundation.org/</a></pre>
</blockquote>
<br>
</body>
</html>