ERROR: ../../rules/snort.rules: unknown rule keyword:
# IDS モード
[root]# /usr/local/snort/bin/snort -c /usr/local/snort/etc/snort/snort.lua
--plugin-path /usr/local/snort/extra -i eth0 -l /var/log/snort
-D -u snort -g snort --create-pidfile -k none
Loading ../../rules/snort.rules:
ERROR: ../../rules/snort.rules:3712 unknown rule keyword: fast_pattern.
.
.
ERROR: ../../rules/snort.rules:3756 unknown rule keyword: fast_pattern.
Finished ../../rules/snort.rules:
● 解決策:
[root]# /usr/local/snort/bin/snort -c /usr/local/snort/etc/snort/snort_defaults.lua -T
Snort successfully validated the configuration (with 0 warnings).
o")~ Snort exiting
[root]# /usr/local/snort/bin/snort -c /usr/local/snort/etc/snort/snort.lua -T
Loading ../../rules/snort.rules:
ERROR: ../../rules/snort.rules:3712 unknown rule keyword: fast_pattern.
ERROR: ../../rules/snort.rules:3712 unknown rule keyword: nocase.
ERROR: ../../rules/snort.rules:3712 unknown/extra pcre option encountered
ERROR: ../../rules/snort.rules:3732 unknown rule keyword: nocase.
ERROR: ../../rules/snort.rules:3732 unknown rule keyword: distance.
ERROR: ../../rules/snort.rules:3732 unknown rule keyword: fast_pattern.
ERROR: ../../rules/snort.rules:3732 unknown rule keyword: nocase.
ERROR: ../../rules/snort.rules:3732 unknown/extra pcre option encountered
ERROR: ../../rules/snort.rules:3756 unknown rule keyword: within.
ERROR: ../../rules/snort.rules:3756 unknown rule keyword: within.
ERROR: ../../rules/snort.rules:3756 unknown rule keyword: distance.
ERROR: ../../rules/snort.rules:3756 unknown rule keyword: within.
ERROR: ../../rules/snort.rules:3756 unknown rule keyword: distance.
ERROR: ../../rules/snort.rules:3756 unknown rule keyword: within.
ERROR: ../../rules/snort.rules:3756 unknown rule keyword: distance.
ERROR: ../../rules/snort.rules:3756 unknown rule keyword: within.
ERROR: ../../rules/snort.rules:3756 unknown rule keyword: distance.
ERROR: ../../rules/snort.rules:3756 unknown rule keyword: within.
ERROR: ../../rules/snort.rules:3756 unknown rule keyword: distance.
ERROR: ../../rules/snort.rules:3756 unknown rule keyword: fast_pattern.
Finished ../../rules/snort.rules:
[root]# vim /usr/local/snort/rules/snort.rules
3712行目 コメントアウト
3732行目 コメントアウト
3756行目 コメントアウト
[root]# /usr/local/snort/bin/snort -c /usr/local/snort/etc/snort/snort.lua -T
Snort successfully validated the configuration (with 0 warnings).
o")~ Snort exiting