# can't launch snort - daq problem?

## lo-jay

installed snort according to this howto http://en.gentoo-wiki.com/wiki/Snort

if i try to launch it i get:

```
/etc/init.d/snort start 

 * Use of the opts variable is deprecated and will be

 * removed in the future.

 * Please use extra_commands, extra_started_commands or extra_stopped_commands.

 * Starting snort ...                                                                                                           [ !! ]

 * ERROR: snort failed to start

```

 *Quote:*   

> /var/log/messages

  shows:

```

FATAL ERROR: Can't find pcap DAQ! 
```

```
ls -l /usr/lib64/daq/ 

total 48

-rwxr-xr-x 1 root root 18512 Jul 21 20:51 daq_afpacket.so

-rwxr-xr-x 1 root root 10304 Jul 21 20:51 daq_dump.so

-rwxr-xr-x 1 root root 14416 Jul 21 20:51 daq_pcap.so

```

&

```
# emerge -av daq

 * IMPORTANT: 5 news items need reading for repository 'gentoo'.

 * Use eselect news to read news items.

These are the packages that would be merged, in order:

Calculating dependencies... done!

[ebuild   R    ] net-libs/daq-0.6.2  USE="afpacket dump ipv6 pcap -ipq -nfq -static-libs" 0 kB

Total: 1 package (1 reinstall), Size of downloads: 0 kB

```

what am i missing???

cheers!

ps:

```
# snort -c /etc/snort/snort.conf

Running in IDS mode

        --== Initializing Snort ==--

Initializing Output Plugins!

Initializing Preprocessors!

Initializing Plug-ins!

Parsing Rules file "/etc/snort/snort.conf"

Tagged Packet Limit: 256

Log directory = /var/log/snort

+++++++++++++++++++++++++++++++++++++++++++++++++++

Initializing rule chains...

0 Snort rules read

    0 detection rules

    0 decoder rules

    0 preprocessor rules

0 Option Chains linked into 0 Chain Headers

0 Dynamic rules

+++++++++++++++++++++++++++++++++++++++++++++++++++

+-------------------[Rule Port Counts]---------------------------------------

|             tcp     udp    icmp      ip

|     src       0       0       0       0

|     dst       0       0       0       0

|     any       0       0       0       0

|      nc       0       0       0       0

|     s+d       0       0       0       0

+----------------------------------------------------------------------------

+-----------------------[detection-filter-config]------------------------------

| memory-cap : 1048576 bytes

+-----------------------[detection-filter-rules]-------------------------------

| none

-------------------------------------------------------------------------------

+-----------------------[rate-filter-config]-----------------------------------

| memory-cap : 1048576 bytes

+-----------------------[rate-filter-rules]------------------------------------

| none

-------------------------------------------------------------------------------

+-----------------------[event-filter-config]----------------------------------

| memory-cap : 1048576 bytes

+-----------------------[event-filter-global]----------------------------------

+-----------------------[event-filter-local]-----------------------------------

| none

+-----------------------[suppression]------------------------------------------

| none

-------------------------------------------------------------------------------

Rule application order: activation->dynamic->pass->drop->sdrop->reject->alert->log

Verifying Preprocessor Configurations!

ERROR: Can't find pcap DAQ!

Fatal Error, Quitting..

```

pps: tinkered .conf a bit but did not get much further:

```

...

Rule application order: activation->dynamic->pass->drop->sdrop->reject->alert->log

Verifying Preprocessor Configurations!

ICMP tracking disabled, no ICMP sessions allocated

IP tracking disabled, no IP sessions allocated

[ Port Based Pattern Matching Memory ]

[ Number of patterns truncated to 20 bytes: 0 ]

afpacket DAQ configured to passive.

The DAQ version does not support reload.

Acquiring network traffic from "eth0".

Reload thread starting...

Reload thread started, thread 0x7f343dccb700 (18639)

Set gid to 993

Set uid to 109

ERROR: database: Connection to database 'snort' failed

Fatal Error, Quitting..

```

----------

## Btoo

Hello,

Does your snort.conf point to the pcap DAQ and the directory it is in?

       config daq: pcap

       config daq_dir: /usr/lib64/daq

Place it near the top, although that doesn't matter.

Btoo

----------

## lo-jay

did that, now it gives:

```
Rule application order: activation->dynamic->pass->drop->sdrop->reject->alert->log

Verifying Preprocessor Configurations!

ICMP tracking disabled, no ICMP sessions allocated

IP tracking disabled, no IP sessions allocated

[ Port Based Pattern Matching Memory ]

[ Number of patterns truncated to 20 bytes: 0 ]

pcap DAQ configured to passive.

The DAQ version does not support reload.

Acquiring network traffic from "eth0".

Reload thread starting...

Reload thread started, thread 0x7fc5d56cb700 (3142)

Decoding Ethernet

Set gid to 993

Set uid to 109

ERROR: database: Connection to database 'snort' failed

Fatal Error, Quitting..

```

btw, is this line correct?

```
output database: log, postgresql, dbname=snort user=snortusr host=localhost
```

?

cheers!

----------

