Simply copying the snort.conf.distrib file to snort.conf I get: n22 /var/log/snort # grep xlink /var/log/messages Jan 27 18:51:28 n22 snort[17960]: FATAL ERROR: /etc/snort/snort.conf(502) unknown preprocessor "xlink2state" Although a config file has to be adapted to the local environment shouldn't the default config file work too ? Reproducible: Always
no, comment that line. the preprocessor may not be compiled with your useflags
Right, comment that line works. Here are my USE flags, which prevents me to use the default file ? n22 ~ # emerge --info Portage 2.1.1-r2 (default-linux/x86/2006.1, gcc-3.4.6, glibc-2.4-r4, 2.6.18-gentoo-r6 i686) ================================================================= System uname: 2.6.18-gentoo-r6 i686 Intel(R) Pentium(R) M processor 1700MHz Gentoo Base System version 1.12.6 Last Sync: Sat, 27 Jan 2007 17:50:01 +0000 ccache version 2.4 [enabled] app-admin/eselect-compiler: [Not Present] dev-java/java-config: 1.3.7, 2.0.31 dev-lang/python: 2.4.3-r4 dev-python/pycrypto: 2.0.1-r5 dev-util/ccache: 2.4-r6 dev-util/confcache: [Not Present] sys-apps/sandbox: 1.2.17 sys-devel/autoconf: 2.13, 2.61 sys-devel/automake: 1.4_p6, 1.5, 1.6.3, 1.7.9-r1, 1.8.5-r3, 1.9.6-r2, 1.10 sys-devel/binutils: 2.16.1-r3 sys-devel/gcc-config: 1.3.14 sys-devel/libtool: 1.5.22 virtual/os-headers: 2.6.17-r2 ACCEPT_KEYWORDS="x86" AUTOCLEAN="yes" CBUILD="i686-pc-linux-gnu" CFLAGS="-O2 -march=pentium-m -fomit-frame-pointer -pipe" CHOST="i686-pc-linux-gnu" CONFIG_PROTECT="/etc /usr/kde/3.5/env /usr/kde/3.5/share/config /usr/kde/3.5/shutdown /usr/share/X11/xkb /usr/share/config" CONFIG_PROTECT_MASK="/etc/env.d /etc/env.d/java/ /etc/gconf /etc/java-config/vms/ /etc/revdep-rebuild /etc/terminfo" CXXFLAGS="-O2 -march=pentium-m -fomit-frame-pointer -pipe" DISTDIR="/usr/portage/distfiles" FEATURES="autoconfig ccache distlocks metadata-transfer parallel-fetch sandbox sfperms strict" GENTOO_MIRRORS="http://pandemonium.tiscali.de/pub/gentoo/ http://85.25.128.62 http://ftp-stud.fht-esslingen.de/pub/Mirrors/gentoo/ http://linux.rz.ruhr-uni-bochum.de/download/gentoo-mirror/" LINGUAS="de en" MAKEOPTS="-j2" PKGDIR="/usr/portage/packages" PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --compress --force --whole-file --delete --delete-after --stats --timeout=180 --exclude='/distfiles' --exclude='/local' --exclude='/packages'" PORTAGE_TMPDIR="/var/tmp" PORTDIR="/usr/portage" PORTDIR_OVERLAY="/usr/local/portage" SYNC="rsync://rsync.de.gentoo.org/gentoo-portage" USE="x86 X aac acpi alsa alsa_cards_intel8x0 alsa_cards_intel8x0m alsa_pcm_plugins_adpcm alsa_pcm_plugins_alaw alsa_pcm_plugins_asym alsa_pcm_plugins_copy alsa_pcm_plugins_dmix alsa_pcm_plugins_dshare alsa_pcm_plugins_dsnoop alsa_pcm_plugins_empty alsa_pcm_plugins_extplug alsa_pcm_plugins_file alsa_pcm_plugins_hooks alsa_pcm_plugins_iec958 alsa_pcm_plugins_ioplug alsa_pcm_plugins_ladspa alsa_pcm_plugins_lfloat alsa_pcm_plugins_linear alsa_pcm_plugins_meter alsa_pcm_plugins_mulaw alsa_pcm_plugins_multi alsa_pcm_plugins_null alsa_pcm_plugins_plug alsa_pcm_plugins_rate alsa_pcm_plugins_route alsa_pcm_plugins_share alsa_pcm_plugins_shm alsa_pcm_plugins_softvol apache2 arts asf berkdb bitmap-fonts bluetooth bzip2 cairo cddb clamav cli cracklib crypt css cups dlloader dri dvd dvdr dvdread elibc_glibc exif fam fastbuild fortran gd gdbm gif gpm gtk gtk2 hdaps i8x0 iconv input_devices_evdev input_devices_joystick input_devices_keyboard input_devices_mouse ipv6 isdnlog jai java javascript jimi jpeg kernel_linux lcd_devices_bayrad lcd_devices_cfontz lcd_devices_cfontz633 lcd_devices_glk lcd_devices_hd44780 lcd_devices_lb216 lcd_devices_lcdm001 lcd_devices_mtxorb lcd_devices_ncurses lcd_devices_text libg++ linguas_de linguas_en logrotate madwifi mbox mikmod mmx mmxext mp3 mp4 mysql ncurses nls nptl nptlonly nsplugin opengl pam pcre pdf perl png ppds pppd python qt4 readline real reflection rtc samba session spl sse sse2 ssl subversion svg tcpd tiff truetype truetype-fonts type1-fonts udev unicode userland_GNU userlocales video_cards_radeon video_cards_vga win32codecs xml xorg xpm zlib" Unset: CTARGET, EMERGE_DEFAULT_OPTS, INSTALL_MASK, LANG, LC_ALL, LDFLAGS, PORTAGE_RSYNC_EXTRA_OPTS
please close the bug yourself
Hopefully get an answer here: http://forums.gentoo.org/viewtopic-p-3879186.html#3879186
