snort problem

[stan]

On Wed, 5 Aug 2009 14:28:49 +0530
RAMAKISHOREBABU KOPPULA <rkbabu.koppula at gmail.com> wrote:

> While system is booting I getting the following message"
> 
> starting: snort   [FAILED]
> 
> What is this and how to rectify it?

These are notes I made to myself when I saw the same thing, and
researched the answer.  Cryptic, but they should give you enough
direction to get snort working.  If the licensing allows, this might be
a great thing to put in rpmfusion-free or rpmfusion-nonfree.  It
probably doesn't.

In order to set up snort to monitor the system network traffic, it is
necessary to install the snort package.  But this is not enough, because
the rules that snort uses are not packaged due to licensing issues.  It
is necessary to go to http://www.snort.org, sign up, log in, and
download the latest snort_rules package.  There are free(older) and
pay(current) versions. 

Create a directory named snort_rules and put the package in that
directory as it does not create its own directory.  Unpack it using tar
-zxvf and move the rules/*.rules files to /etc/snort/rules/.  Cp the
so_rules/precompiled/FC-9/x86_64/2.8.3.2/*.so to
/usr/local/lib64/snort_dynamicrule/.  The instructions to create the
stubs and tell snort about them are in the README in the so_rules/src
directory.  They work.

Because the package is already installed, only the dynamic detection
directory has to be changed in /etc/snort/snort.conf to the
/usr/local/lib64/snort_dynamicrule location.  Everything else uses
the main hierarchy.  So the stub dump command becomes snort -c
/etc/snort/snort.conf --dump-dynamic-rules=/etc/snort/so_rules

Note that snort will not create these directories and will fail if they
don't already exist.