Snort failing at Boot

[Paul Howarth]

Mark Sargent wrote:
> Paul Howarth wrote:
> 
>> On Wed, 2005-03-30 at 15:50 +0900, Mark Sargent wrote:
>>  
>>
>>> Hi All,
>>>
>>> I have snort set to start up at boot, but, get an error and it fails. 
>>> I have checked messages and boot.log, but nothing showing what the 
>>> actual problem is. It was due to a file not being found, but I wasn't 
>>> quick enuff to write it down. Where else would I find this info other 
>>> than the 2 logs I mentioned.? Cheers.
>>>   
>>
>>
>> Try running the snort initscript again like it would be run at boot
>> time.
>>
>> # service snort start
>>
>> Paul.
>>  
>>
> Hi All,
> 
> thanx, Paul. This is a source install as it's required to have snort 
> work with mysql. I followed the tutorial by Patrick Harper, found at his 
> site,
> http://www.whitefrog.com/
> and get the following with the service snort start,
> [root at localhost ~]# service snort start
> snort: unrecognized service
> I rebooted and was quick enuff to record the error message,
> 
> It gives an error related to this line in the /etc/snort/snort.conf file,
> 
> preprocessor http_inspect: global \
>   iis_unicode_map unicode.map 1252
> 
> something about not finding unicode.map.

There should be a file unicode.map in /etc/snort

If there isn't, you didn't follow the instructions in the tutorial just 
before "Modify your snort.conf file", which should have installed this 
and other files.

Paul.