<html><body><div style="font-family: courier new,courier,monaco,monospace,sans-serif; font-size: 10pt; color: #000000"><div data-marker="__QUOTED_TEXT__">Hello,<br><br>Have upgraded to Suricata v4.0.1 and now the IP reputation is no longer working. The error when I check the configuration is:<br><br>3/11/2017 -- 14:38:01 - <Error> - [ERRCODE: SC_ERR_UNKNOWN_VALUE(129)] - unknown iprep category "BadHosts"<br>3/11/2017 -- 14:38:01 - <Error> - [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "alert ip any any -> any any (msg:"IPREP High Risk"; iprep:src,BadHosts,>,99; sid:3790031; rev:1;)" from file /etc/suricata/rules/local.rules at line 2<br>3/11/2017 -- 14:38:01 - <Error> - [ERRCODE: SC_ERR_NO_RULES_LOADED(43)] - Loading signatures failed.<br><br>and the rule that is in use:<br><br>alert ip any any -> any any (msg:"IPREP High Risk"; iprep:src,BadHosts,>,99; sid:3790031; rev:1;)<br><br>It believes that the category is not there but it is:<br><br>cat /etc/suricata/iprep/categories.txt<br>1,BadHosts,Bad Host<br>2,GoodHosts,Known Good Host<br><br>and is being referenced correctly in suricata.yaml:<br><br># IP Reputation<br>reputation-categories-file: /etc/suricata/iprep/categories.txt<br>default-reputation-path: /etc/suricata/iprep<br>reputation-files:<br> - reputation.list<br><br>Any thoughts as to what the error is please ?<br><br>Thanks - Phil</div><br></div>
<br><br>
<br><pre></pre><br></body></html>