[Oisf-users] HOME_NET is not defined?

[Dewhirst, Rob]

It's not a rule but an error in the log I get whenever I start suricata.

[469] 24/12/2011 -- 09:58:58 - (util-rule-vars.c:96) <Error>
(SCRuleVarsGetConfVar) -- [ERRCODE: SC_ERR_UNDEFINED_VAR(99)] -
Variable "HOME_NET" is not defined in configuration file

I'll have to send the yaml file to you off-list to avoid heavy redaction.

On Tue, Jan 3, 2012 at 8:52 AM, Victor Julien <victor at inliniac.net> wrote:
> On 01/03/2012 03:50 PM, Dewhirst, Rob wrote:
>> Checked.  Only four spaces.
>
> Can you attach your suricata.yaml and the offending rule?
>
> Cheers,
> Victor
>
>> On Mon, Jan 2, 2012 at 6:15 AM, Victor Julien <victor at inliniac.net> wrote:
>>> On 12/24/2011 05:40 PM, Dewhirst, Rob wrote:
>>>> [469] 24/12/2011 -- 09:58:58 - (util-rule-vars.c:96) <Error>
>>>> (SCRuleVarsGetConfVar) -- [ERRCODE: SC_ERR_UNDEFINED_VAR(99)] -
>>>> Variable "HOME_NET" is not defined in configuration file
>>>>
>>>> /etc/suricata/suricata.yaml:
>>>>
>>>> vars:
>>>>
>>>>   # Holds the address group vars that would be passed in a Signature.
>>>>   # These would be retrieved during the Signature address parsing stage.
>>>>   address-groups:
>>>>
>>>>     HOME_NET: "[122.137.0.0/16,10.0.0.0/8]"
>>>>
>>>> No sure what is going on here.  My HOME_NET definition looks fine.
>>>
>>> The yaml file format is sensitive to indentation errors. Make sure only
>>> 4 spaces are on the HOME_NET line before it.
>>>
>>> --
>>> ---------------------------------------------
>>> Victor Julien
>>> http://www.inliniac.net/
>>> PGP: http://www.inliniac.net/victorjulien.asc
>>> ---------------------------------------------
>>>
>>> _______________________________________________
>>> Oisf-users mailing list
>>> Oisf-users at openinfosecfoundation.org
>>> http://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users
>> _______________________________________________
>> Oisf-users mailing list
>> Oisf-users at openinfosecfoundation.org
>> http://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users
>>
>
>
> --
> ---------------------------------------------
> Victor Julien
> http://www.inliniac.net/
> PGP: http://www.inliniac.net/victorjulien.asc
> ---------------------------------------------
>
> _______________________________________________
> Oisf-users mailing list
> Oisf-users at openinfosecfoundation.org
> http://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users