[Oisf-users] Having trouble configuring Suricata on Windows Server 2012

[Jason Richardson]

Hi all, I'm a new Suricata user and subscriber to this listserv. I've been a Snort user for a number of years and we're currently using Snort as our IDS system. A friend suggested that we take a look at Suricata and I happen to have a new server (hand me down, but new to us) to test it on. The problem that I am running into on either 2.0rc2 or 1.4.7 is that, despite editing all of the appropriate stanzas in suricata.yaml, I'm getting an error indicating that the magic file is failing to load. I already submitted this as a bug before I found this listserv - see below.

Thanks in advance for any suggestions.


Bug #1148: 1.4.7 will not run on Windows Server 2012 because magic file will not load

https://redmine.openinfosecfoundation.org/issues/1148

Installed 2.0rc2 and then back-revved to 1.4.7 but I get the same error, despite editing all of the relevant paths in suricata.yaml



[ERRCODE: UNKNOWN_ERROR(197)] - magic_load failed: count not find any magic files!



The relevant stanza in my suricata.yaml is as follows (and the path is correct):

magic-file: D:\Suricata\magic.mgc

Jason Richardson
IT Security Analyst
Information Technology Services
Bowling Green State University
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openinfosecfoundation.org/pipermail/oisf-users/attachments/20140314/561a735a/attachment.html>