On Sunday, August 23, 2015 8:27:17 AM Rod wrote: > > Snipped out the previous, takes a while to scroll... > > On 08/23/2015 07:40 AM, Fernando Rodriguez wrote: > > Post the output of: emerge -vap snort and then: USE=normalizer emerge > > -vap snort The only way NormFlags is left out (as far as I can see) is > > if you disable that flag (which is enabled by default). > > # emerge -pqv '=net-analyzer/snort-2.9.7.5::gentoo' > > [ebuild U ] net-analyzer/snort-2.9.7.5 [2.9.1] USE="threads > -active-response -control-socket% -debug -file-inspect% -flexresp3 -gre > -high-availability% -inline-init-failopen -large-pcap-64bit > -linux-smp-stats -mpls -non-ether-decoders% -normalizer -perfprofiling > -ppm -react -reload-error-restart (-selinux*) -shared-rep% > -side-channel% -sourcefire% -static -targetbased (-aruba%) > (-decoder-preprocessor-rules%) (-dynamicplugin%*) (-mysql%*) (-odbc%*) > (-paf%) (-postgres%*) (-zlib%*)" > > Ahhh, ok, I see it, "-normalizer" > > Maybe on newer install systems its enabled by default, but I have > been running this system with Snort on it for 10 years or so... and I > don't think "normalizer" would be that old in the"USE" flags, opening > `ufed` it doesn't show it as included or enabled, I have enabled it. > > # USE=normalizer emerge -vap snort > > [ebuild U ~] net-analyzer/snort-2.9.7.5::gentoo [2.9.1::gentoo] > USE="normalizer* threads -active-response -control-socket% -debug > -file-inspect% -flexresp3 -gre -high-availability% -inline-init-failopen > -large-pcap-64bit -linux-smp-stats -mpls -non-ether-decoders% > -perfprofiling -ppm -react -reload-error-restart (-selinux*) > -shared-rep% -side-channel% -sourcefire% -static -targetbased (-aruba%) > (-decoder-preprocessor-rules%) (-dynamicplugin%*) (-mysql%*) (-odbc%*) > (-paf%) (-postgres%*) (-zlib%*)" 0 KiB > > No luck I'm afraid
grep your package.* in /etc/portage for snort entries. I didn't investigate which one is breaking this time but it must be something you got there somewhere. I just built it with the default use flags and it works. If it was profile changes you would've got them when you sync'd. And don't forget to file a bug. -- Fernando Rodriguez
