Bug 388221 - /usr/sbin/snort is missing
/usr/sbin/snort is missing
Status: CLOSED ERRATA
Product: Fedora
Classification: Fedora
Component: snort (Show other bugs)
8
i386 Linux
low Severity low
: ---
: ---
Assigned To: Dennis Gilmore
Fedora Extras Quality Assurance
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2007-11-17 05:21 EST by Lyle Lasheimok
Modified: 2007-11-30 17:12 EST (History)
2 users (show)

See Also:
Fixed In Version: 2.7.0.1-5.fc8
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2007-11-28 20:40:06 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Lyle Lasheimok 2007-11-17 05:21:04 EST
Description of problem:

After installing snort on F8, it tries to start automatically, but can't find
the non existing file /usr/sbin/snort.
There's a broken link /usr/bin/snort, which refers to /etc/alternatives/snort,
which refers to /usr/bin/snort-plain, which doesn't exist.

Version-Release number of selected component (if applicable):

snort-2.7.0.1-3.fc8

How reproducible:

Hm. I didn't try to reproduce it by installing a fresh system again. I just
assume it will install the same files.

Steps to Reproduce:
1. Install F8
2. Install snort
3. /etc/init.d/snortd start
  
Actual results:

Starting snort: /bin/bash: /usr/sbin/snort: No such file or directory
                                                           [FAILED]

Expected results:

Starting snort                                             [  OK  ]

Additional info:

At first I installed just snort, not any of the additional packages. I don't
know whether they are needed, but they are not dependencies.
Then I tried to also install snort-plain+flexresp, but it didn't help.
Comment 1 Fedora Update System 2007-11-20 12:55:31 EST
snort-2.7.0.1-5.fc8 has been pushed to the Fedora 8 testing repository.  If problems still persist, please make note of it in this bug report.
 If you want to test the update, you can install it with 
 su -c 'yum --enablerepo=updates-testing update snort'
Comment 2 Lyle Lasheimok 2007-11-21 09:24:45 EST
Sorry, I couldn't install the update:

# rpm -aq | grep snort
snort-2.7.0.1-3.fc8
# yum --enablerepo=updates-testing update snort
updates-testing           100% |=========================| 2.3 kB    00:00
Setting up Update Process
Could not find update match for snort
No Packages marked for Update
Comment 3 Dennis Gilmore 2007-11-21 11:10:54 EST
please try again in a few hours.  the mirror your using could be not quite 
caught up yet.
Comment 4 Lyle Lasheimok 2007-11-25 07:44:22 EST
The update didn't help. :( Snort still won't start.

I tried to reinstall it to make sure I didn't break anything myself, but I
couldn't uninstall it, it complained about snort-plain not being configured as
an alternative for snort.

I hoped installing something as snort-plain would help, so I installed
snort-plain+flexresp, now I get the following error message when I try to
uninstall snort:

$ sudo rpm -e snort snort-plain+flexresp
/usr/sbin/snort-plain+flexresp has not been configured as an alternative for snort
error: %postun(snort-plain+flexresp-2.7.0.1-5.fc8.i386) scriptlet failed, exit
status 2
Stopping snort: [FAILED]
/usr/sbin/snort-plain has not been configured as an alternative for snort
error: %preun(snort-2.7.0.1-5.fc8.i386) scriptlet failed, exit status 2

Any idea?
Comment 5 Dennis Gilmore 2007-11-25 10:59:37 EST
try running 
sudo rpm -e --noscripts snort snort-plain+flexresp

then reinstall snort
Comment 6 Lyle Lasheimok 2007-11-25 11:31:09 EST
Hi, thank you for helping!

That worked. :)

Kind of.

It still fails to start and leaves an error message in /var/log/messages:
FATAL ERROR: Unable to open rules file: /etc/local.rules or
/etc/snort//etc/local.rules

But that's probably because I didn't set it up yet.
Comment 7 Dennis Gilmore 2007-11-25 11:56:38 EST
because of the licensing of the snort rules we cant ship them 

I need to spend some time a ship the community supplied rules that are GPL  
and have the config Just work.  

Comment 8 jon 2007-11-26 17:52:09 EST
Even after updating from testing I'm still getting the same error.  Obviously I
know I just need to change the path to the binary to /usr/sbin/snort-mysql so
it's not a show stopper, just wanted to let you know.

[root@host yum.repos.d]# yum --enablerepo=updates-testing update snort
[yadda yadda]
Total download size: 1.9 M
Is this ok [y/N]: y
Downloading Packages:
(1/2): snort-mysql-2.7.0. 100% |=========================| 275 kB    00:00
(2/2): snort-2.7.0.1-5.fc 100% |=========================| 1.6 MB    00:02
Running rpm_check_debug
Running Transaction Test
Finished Transaction Test
Transaction Test Succeeded
Running Transaction
  Updating  : snort                        ######################### [1/4]
  Updating  : snort-mysql                  ######################### [2/4]
  Cleanup   : snort                        ######################### [3/4]
Stopping snort: [FAILED]
  Cleanup   : snort-mysql                  ######################### [4/4]

Updated: snort.i386 0:2.7.0.1-5.fc8
Dependency Updated: snort-mysql.i386 0:2.7.0.1-5.fc8
Complete!
[root@host yum.repos.d]# service snortd start
Starting snort: /bin/bash: /usr/sbin/snort: No such file or directory
                                                           [FAILED]


Comment 9 Dennis Gilmore 2007-11-26 18:13:16 EST
alternatives really does not like that the path was wrong.  

i would sugest you run 
rpm -e --noscripts snort snort-mysql   then install them over  then use 
alternatives to set the version of snort you want to use


the ugly manual symlinking is no more 
Comment 10 jon 2007-11-28 15:09:27 EST
I'm sorry dennis, I'm not following you.  What do you mean by alternatives?
Comment 11 Dennis Gilmore 2007-11-28 15:18:15 EST
run 
man alternatives

it is a system that allows you to manage 

alternatives  creates,  removes,  maintains and displays information about the 
symbolic links comprising the alternatives system. The alternatives system is 
a reimplementation of
       the Debian alternatives system. It was rewritten primarily to remove 
the dependence on perl; it is intended to be a drop in replacement for 
Debian’s  update-dependencies  script.
       This man page is a slightly modified version of the man page from the 
Debian project.
Comment 12 Fedora Update System 2007-11-28 20:40:05 EST
snort-2.7.0.1-5.fc8 has been pushed to the Fedora 8 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 13 jon 2007-11-29 16:08:33 EST
Does this mean it will be available in the yum "fedora" or "fedora updates"
mirrors once they update?

Note You need to log in before you can comment on or make changes to this bug.