[Oisf-users] Error compiling Suricata on CentOS7 with pfring 6.4.1.

[fatema bannatwala]

So I finally figured out the issue with the compiling, and compiled
suricata successfully.
I compiled it with following:

$ ./configure --prefix=/usr/local/suricata/3.2.1
--sysconfdir=/usr/local/suricata/3.2.1/etc
--localstatedir=/usr/local/suricata/var --enable-pfring
--with-libpfring-includes=/usr/local/pfring/6.4.1/include
--with-libpfring-libraries=/usr/local/pfring/6.4.1/lib
 --with-libpcap-includes=/usr/local/pfring/6.4.1/include
--with-libpcap-libraries=/usr/local/pfring/6.4.1/lib --enable-gccprotect
--enable-profiling --enable-old-barnyard2

And did a make install after that:

$make
$sudo make install
$sudo ldconfig

Everything successfully completed.
But when I tried running it, I get error:

# ./suricata -i p1p1 -c /usr/local/suricata/3.2.1/etc/suricata/suricata.yaml
/usr/local/suricata/3.2.1/bin/suricata: error while loading shared
libraries: libpfring.so: cannot open shared object file: No such file or
directory

When I checked the library linkage for suri binary, I find it is not
linking with the libpfring that I passed during the compilation of the
binary:
# ldd /usr/local/suricata/3.2.1/bin/suricata
 <snip>
        libpfring.so => not found

I know the work around, manually adding the pfring lib path to the
/etc/ld.so.conf file, but don't want to do that.
I'd rather see the binary compiled so it looks in the right place to load
the libs rather than edit ld.so.conf and effect everything.

Is there something I missed during the compiling step, or this is the
normal behavior of suricata?

PS: I am testing this out on a CentOS 7 system.

Any help would be appreciated.

Thanks,
Fatema.




On Thu, Apr 20, 2017 at 12:47 PM, fatema bannatwala <
fatema.bannatwala at gmail.com> wrote:

> Hi All,
>
> I am new to suricata, and am trying to compile it on a Linux machine
> running CentOS7.3.
> I have pfring installed already on the machine that works with other IDSs
> just fine.
>
> When I am trying to configure suricata I get following error:
>
>
> $ ./configure --prefix=/usr/local/suricata/3.2.1 --sysconfdir=/usr/local/suricata/3.2.1/etc
> --localstatedir=/usr/local/suricata/var --enable-pfring
> --with-libpfring-includes=/usr/local/pfring/6.4.1/include
> --with-libpfring-libraries=/usr/local/pfring/6.4.1/lib
>
> <snip>
> ..
> checking pcap.h usability... yes
> checking pcap.h presence... yes
> checking for pcap.h... yes
> checking for pcap.h... (cached) yes
> checking pcap/pcap.h usability... yes
> checking pcap/pcap.h presence... yes
> checking for pcap/pcap.h... yes
> checking pcap/bpf.h usability... yes
> checking pcap/bpf.h presence... yes
> checking for pcap/bpf.h... yes
> checking for pcap_open_live in -lpcap... yes
> checking for pcap_activate in -lpcap... yes
> checking for pcap-config... /usr/bin/pcap-config
> checking for pcap_set_buffer_size in -lpcap... yes
> checking for pfring_open in -lpfring... yes
>
>    ERROR! --enable-pfring was passed but the library version is < 6, go
> get it
>    from http://www.ntop.org/products/pf_ring/
>
> Not sure what I am missing here. Any help would be appreciated.
>
> Thanks,
> Fatema.
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openinfosecfoundation.org/pipermail/oisf-users/attachments/20170426/85e2dd67/attachment-0002.html>