On Sunday, August 23, 2015 3:26:24 PM Rod wrote: > > On 08/23/2015 08:59 AM, Fernando Rodriguez wrote: > > On Sunday, August 23, 2015 8:27:17 AM Rod wrote: > >> Snipped out the previous, takes a while to scroll... > >> > >> On 08/23/2015 07:40 AM, Fernando Rodriguez wrote: > >>> Post the output of: emerge -vap snort and then: USE=normalizer emerge > >>> -vap snort The only way NormFlags is left out (as far as I can see) is > >>> if you disable that flag (which is enabled by default). > >> # emerge -pqv '=net-analyzer/snort-2.9.7.5::gentoo' > >> > >> [ebuild U ] net-analyzer/snort-2.9.7.5 [2.9.1] USE="threads > >> -active-response -control-socket% -debug -file-inspect% -flexresp3 -gre > >> -high-availability% -inline-init-failopen -large-pcap-64bit > >> -linux-smp-stats -mpls -non-ether-decoders% -normalizer -perfprofiling > >> -ppm -react -reload-error-restart (-selinux*) -shared-rep% > >> -side-channel% -sourcefire% -static -targetbased (-aruba%) > >> (-decoder-preprocessor-rules%) (-dynamicplugin%*) (-mysql%*) (-odbc%*) > >> (-paf%) (-postgres%*) (-zlib%*)" > >> > >> Ahhh, ok, I see it, "-normalizer" > >> > >> Maybe on newer install systems its enabled by default, but I have > >> been running this system with Snort on it for 10 years or so... and I > >> don't think "normalizer" would be that old in the"USE" flags, opening > >> `ufed` it doesn't show it as included or enabled, I have enabled it. > >> > >> # USE=normalizer emerge -vap snort > >> > >> [ebuild U ~] net-analyzer/snort-2.9.7.5::gentoo [2.9.1::gentoo] > >> USE="normalizer* threads -active-response -control-socket% -debug > >> -file-inspect% -flexresp3 -gre -high-availability% -inline-init-failopen > >> -large-pcap-64bit -linux-smp-stats -mpls -non-ether-decoders% > >> -perfprofiling -ppm -react -reload-error-restart (-selinux*) > >> -shared-rep% -side-channel% -sourcefire% -static -targetbased (-aruba%) > >> (-decoder-preprocessor-rules%) (-dynamicplugin%*) (-mysql%*) (-odbc%*) > >> (-paf%) (-postgres%*) (-zlib%*)" 0 KiB > >> > >> No luck I'm afraid > > grep your package.* in /etc/portage for snort entries. I didn't investigate > > which one is breaking this time but it must be something you got there > > somewhere. I just built it with the default use flags and it works. If it was > > profile changes you would've got them when you sync'd. > > > > And don't forget to file a bug. > > net-analyzer/snort ~amd64 > > # required by net-analyzer/snort-2.9.6.1 > # required by @selected > # required by @world (argument) > =net-libs/daq-2.0.2 ~amd64
When was the last time you sync'd? And did a world update? Your portage is two versions behind mine... This *should* work: USE="active-response flexresp3 gre mpls non-ether-decoders normalizer perfprofiling ppm react targetbased threads" emerge snort Hopefully somebody else can help figure out why those use flags are disabled, they're enabled in my ebuild. For now add those flags to your package.use. -- Fernando Rodriguez
