Bug 164257 – stabilize dev-libs/libprelude-0.9.10 for net-analyzer/snort-2.6.1.2

• Product: Gentoo Linux
• Status: RESOLVED DUPLICATE

[Description Giampaolo Tomassoni 2007-01-28 16:33:51 UTC]

On a "stable" gentoo, attempting to emerge snort with "prelude" use flag on, results on a message stating "checking for libprelude - version >= 0.9.6... no" during snort's configure phase. The snort built this way can't contact prelude.

I guess that a fix would be to "stable" any suitable libprelude version >= 0.9.6.

Reproducible: Always

Steps to Reproduce:
1.On a stable gentoo: USE=prelude emerge snort
2.
3.



Expected Results:  
---snip---
checking for libprelude-config... /usr/bin/libprelude-config
checking for libprelude - version >= 0.9.6... no
*** An old version of LIBPRELUDE (0.9.3) was found.
*** You need a version of LIBPRELUDE newer than 0.9.6. The latest version of
*** LIBPRELUDE is always available from http://www.prelude-ids.org/download/releases.
***
*** If you have already installed a sufficiently new version, this error
*** probably means that the wrong copy of the libprelude-config shell script is
*** being found. The easiest way to fix this is to remove the old version
*** of LIBPRELUDE, but you can also set the LIBPRELUDE_CONFIG environment to point to the
*** correct copy of libprelude-config. (In this case, you will have to
*** modify your LD_LIBRARY_PATH enviroment variable, or edit /etc/ld.so.conf
*** so that the correct libraries are found at run-time))
---snip---

The workaround is to unmask a libprelude >= 0.9.6

[Comment 1 Jon Gerdes 2007-04-27 10:25:00 UTC]

I've just found the same problem - wondered why Snort was failing to connect to Prelude.

[Comment 2 Daniel Black (RETIRED) 2007-05-20 04:29:46 UTC]

Jon,Giampaolo does prelude 0.9.12.1 work ok for you?

[Comment 3 Giampaolo Tomassoni 2007-05-20 17:13:45 UTC]

(In reply to comment #2)
> Jon,Giampaolo does prelude 0.9.12.1 work ok for you?

Unfortunately, I can't tell it. At the time of my report I was trying to install snort + barnyard + prelude. Unfortunately, while the fix for prelude was easy, the barnyard package was unable to handle the new version of the unified format (the one with a 0x2dac5ceb header magic) and configuring snort to produce unified logs in the old version caused snort itself to crash (due to SIGSEGV...).

This happened with either net-analyzer/snort-2.6.1.3-r1 and net-analyzer/snort-2.6.1.4, with net-analyzer/barnyard-0.2.0-r1 and net-analyzer/barnyard-0.2.0-r2.

Thereby, I relegated all the snort-related stuff to the "funny thingeries" and stopped any further attempts.

Maybe Jon has some more bits to spare...

[Comment 4 Markus Ullmann (RETIRED) 2007-09-05 18:16:38 UTC]

tracking this in one bug now

*** This bug has been marked as a duplicate of bug 191415 ***