[Oisf-users] Getting error when running Suricata

[jason taylor]

Responses inline.

On Thu, 2017-11-30 at 19:34 -0600, Leonard Jacobs wrote:
> Ubuntu 16.04
> Compiled Suricata after installing Hyperscan.
> I followed the instructions in documentation.
Do you recall if you ran ldconfig post build/install?
 
> Give me specifically what you want with ldd.  Better Example?
you can run exactly 'ldd $(which suricata)' or if you know the full
path to the suricata binary you are launching just run 'ldd
/path/to/suricata/here'.

For example on my machine:
[jason at dinosaur ~]$ ldd $(which suricata)
	linux-vdso.so.1 (0x00007ffff53fc000)
	liblua-5.3.so => /lib64/liblua-5.3.so (0x00007fe2235c4000)
	libhtp.so.2 => /lib64/libhtp.so.2 (0x00007fe2233a4000)
	libz.so.1 => /lib64/libz.so.1 (0x00007fe22318d000)
	librt.so.1 => /lib64/librt.so.1 (0x00007fe222f85000)
	libm.so.6 => /lib64/libm.so.6 (0x00007fe222c30000)
	libevent_pthreads-2.0.so.5 => /lib64/libevent_pthreads-2.0.so.5 
(0x00007fe222a2d000)
	libevent-2.0.so.5 => /lib64/libevent-2.0.so.5
(0x00007fe2227e4000)
	libhiredis.so.0.13 => /lib64/libhiredis.so.0.13
(0x00007fe2225d6000)
	libGeoIP.so.1 => /lib64/libGeoIP.so.1 (0x00007fe2223a1000)
	libmagic.so.1 => /lib64/libmagic.so.1 (0x00007fe22217d000)
	libcap-ng.so.0 => /lib64/libcap-ng.so.0 (0x00007fe221f77000)
	libpcap.so.1 => /lib64/libpcap.so.1 (0x00007fe221d34000)
	libnet.so.1 => /lib64/libnet.so.1 (0x00007fe221b1a000)
	libnetfilter_queue.so.1 => /lib64/libnetfilter_queue.so.1
(0x00007fe221913000)
	libnfnetlink.so.0 => /lib64/libnfnetlink.so.0
(0x00007fe22170d000)
	libjansson.so.4 => /lib64/libjansson.so.4 (0x00007fe2214ff000)
	libyaml-0.so.2 => /lib64/libyaml-0.so.2 (0x00007fe2212e1000)
	libpcre.so.1 => /lib64/libpcre.so.1 (0x00007fe22106e000)
	libhs.so.4 => /lib64/libhs.so.4 (0x00007fe220713000)
	libgcc_s.so.1 => /lib64/libgcc_s.so.1 (0x00007fe21e755000)
<snipped output>
> I have installed Suricata numerous times but never had this problem. 
> Can't even run suricata --build-info without error.  After running
> ./configure I saw that Hyperscan was enabled.
> 
> From: Jason Taylor <jtfas90 at gmail.com> 
> To: Leonard Jacobs <ljacobs at netsecuris.com> 
> Cc: <oisf-users at lists.openinfosecfoundation.org> 
> Sent: 11/30/2017 6:40 PM 
> Subject: Re: [Oisf-users] Getting error when running Suricata 
> 
> > Hi Leonard,
> > 
> > What OS is this running on? 
> > 
> > How did suricata get installed?
> > 
> > How did hyperscan get installed?
> > 
> > Can you post the output of  'ldd $(which suricata)' ?
> > 
> > Thanks!
> > 
> > JT
> > 
> > On Nov 30, 2017 19:10, "Leonard Jacobs" <ljacobs at netsecuris.com>
> > wrote:
> > > I am getting the following error when running anything with
> > > suricata.  I am not sure what it means.  I can see libhs.so.4
> > > file in /usr/local/lib/x86_64-linux-gnu/ directory.
> > > 
> > > suricata: error while loading shared libraries: libhs.so.4:
> > > cannot open shared object file: No such file or directory
> > > 
> > > 
> > > _______________________________________________
> > > Suricata IDS Users mailing list: oisf-users at openinfosecfoundation
> > > .org
> > > Site: http://suricata-ids.org | Support: http://suricata-ids.org/
> > > support/
> > > List: https://lists.openinfosecfoundation.org/mailman/listinfo/oi
> > > sf-users
> > > 
> > > Conference: https://suricon.net
> > > Trainings: https://suricata-ids.org/training/