Snort Forums Archive

Archive Home » Snort Development » Threshold.conf parse error

Please note that the categories listed below represent an archived version of our forums pages. To view the current version and be able to post and reply to threads, please register and login here to go to the full forums pages.

[ Notice: Full Version of This Topic ]

Threshold.conf parse error

Posted by Christian on May 10, 2005 00:31:17

Hi

When adding comment to line in threshold.conf I get the following error when using "$" char.

suppress gen_id 106, sig_id 4 # Test Parse now with $VARIABLE
snort: FATAL ERROR: Undefined variable name: (/etc/snort/threshold.conf:13): VARIABLE

Following works
suppress gen_id 106, sig_id 4 # Test Parse now without

So I guess it’s a parse issue with the comment part.

/Christian Svensson

Tested on 2.3.3 (was same bug in 2.3.2)

Posted by roesch on June 28, 2005 12:04:10

It's a parser bug. Snort doesn't support comments on the same line with directives in its config files. (I'm terrible at coding parsers, this is proof). ;)

-Marty