Snort refuses to read config file

I'm running RH 9.0 and I just installed snort-2.1.1 by running

./configure ; make install

Everything seems to work out fine. I can run snort by itself and it works fine.

snort -A fast -i eth1 -D

But when I specify snort.conf to implement the rules....

snort -A fast -i eth1 -c ./snort.conf

Running in IDS mode

<cut>

Initializing rule chains...

<cut>

telnet_decode arguments:
Ports to decode telnet on: 21 23 25 119
ERROR: Undefined variable name: (snort.conf:563): 10
Fatal Error, Quitting..

Any suggestions would be much appreciated.

ERROR: Undefined variable name: (snort.conf:563): 10
"vi snort.conf +563" and check the variable.
Else post that part (-/+ 10 lines) of your conf

This is a new error, I figured out the old on.


ERROR: snort.conf(285) => Invalid file name for IIS Unicode Map file.
Fatal Error, Quitting..

<line 285>
preprocessor http_inspect: global \
iis_unicode_map unicode.map 1252
<line 285>

This is a brand new snort.conf, one I haven't messed with. And I checked /rules and it does contain unicode.map.


Thanks, oh and I never new you could vi straight to the error with a +<line#> ... very cool.

preprocessor http_inspect: global iis_unicode_map unicode.map 1252
Path to file. Add this line at the top of your snort.conf (adjust location):
var RULE_PATH /etc/snort/rules
Then chng line:
preprocessor http_inspect: global iis_unicode_map $RULE_PATH/unicode.map 1252
Now run Snort in test mode, add flag "-T".

I had the same problem. You have to copy the unicode.map file to the same location as the snort.conf file. (Or change the path in snort.conf like suggested above, but that didn't work on my installation)