Re: [gentoo-user] Snort compiling problems

[Rod]

On 08/23/2015 03:59 PM, Fernando Rodriguez wrote:
> On Sunday, August 23, 2015 3:26:24 PM Rod wrote:
>> On 08/23/2015 08:59 AM, Fernando Rodriguez wrote:
>>> On Sunday, August 23, 2015 8:27:17 AM Rod wrote:
>>>>        Snipped out the previous, takes a while to scroll...
>>>>
>>>> On 08/23/2015 07:40 AM, Fernando Rodriguez wrote:
>>>>> Post the output of: emerge -vap snort and then: USE=normalizer emerge
>>>>> -vap snort The only way NormFlags is left out (as far as I can see) is
>>>>> if you disable that flag (which is enabled by default).
>>>> # emerge -pqv '=net-analyzer/snort-2.9.7.5::gentoo'
>>>>
>>>> [ebuild     U ] net-analyzer/snort-2.9.7.5 [2.9.1] USE="threads
>>>> -active-response -control-socket% -debug -file-inspect% -flexresp3 -gre
>>>> -high-availability% -inline-init-failopen -large-pcap-64bit
>>>> -linux-smp-stats -mpls -non-ether-decoders% -normalizer -perfprofiling
>>>> -ppm -react -reload-error-restart (-selinux*) -shared-rep%
>>>> -side-channel% -sourcefire% -static -targetbased (-aruba%)
>>>> (-decoder-preprocessor-rules%) (-dynamicplugin%*) (-mysql%*) (-odbc%*)
>>>> (-paf%) (-postgres%*) (-zlib%*)"
>>>>
>>>> Ahhh, ok, I see it, "-normalizer"
>>>>
>>>>        Maybe on newer install systems its enabled by default, but I have
>>>> been running this system with Snort on it for 10 years or so... and I
>>>> don't think "normalizer" would be that old in the"USE" flags, opening
>>>> `ufed` it doesn't show it as included or enabled, I have enabled it.
>>>>
>>>> # USE=normalizer emerge -vap snort
>>>>
>>>> [ebuild     U ~] net-analyzer/snort-2.9.7.5::gentoo [2.9.1::gentoo]
>>>> USE="normalizer* threads -active-response -control-socket% -debug
>>>> -file-inspect% -flexresp3 -gre -high-availability% -inline-init-failopen
>>>> -large-pcap-64bit -linux-smp-stats -mpls -non-ether-decoders%
>>>> -perfprofiling -ppm -react -reload-error-restart (-selinux*)
>>>> -shared-rep% -side-channel% -sourcefire% -static -targetbased (-aruba%)
>>>> (-decoder-preprocessor-rules%) (-dynamicplugin%*) (-mysql%*) (-odbc%*)
>>>> (-paf%) (-postgres%*) (-zlib%*)" 0 KiB
>>>>
>>>> No luck I'm afraid
>>> grep your package.* in /etc/portage for snort entries. I didn't
> investigate
>>> which one is breaking this time but it must be something you got there
>>> somewhere. I just built it with the default use flags and it works. If it
> was
>>> profile changes you would've got them when you sync'd.
>>>
>>> And don't forget to file a bug.
>> net-analyzer/snort              ~amd64
>>
>> # required by net-analyzer/snort-2.9.6.1
>> # required by @selected
>> # required by @world (argument)
>> =net-libs/daq-2.0.2 ~amd64
> When was the last time you sync'd? And did a world update? Your portage is two
> versions behind mine...
>
> This *should* work:
>
> USE="active-response flexresp3 gre mpls non-ether-decoders normalizer
> perfprofiling ppm react targetbased threads" emerge snort
>
> Hopefully somebody else can help figure out why those use flags are disabled,
> they're enabled in my ebuild. For now add those flags to your package.use.

     emerge sync is every night (once every 24Hrs) and the portage 
directory is NFS shared to all other computers on this home network,

Bug has been filed to here -> https://bugs.gentoo.org/show_bug.cgi?id=558454


     Ok, thats a bugger..... Grrr (now)

     I have added your "USE" (above) to package.use, recompiled, nothing 
changed, still bombed at "Stream 6" then tried without changing 
anything, your USE="active.......threads" emerge snort and it happily 
compiled, and installed :( now I don't know why... I submitted the bug 
report (previous Email request) then typed this Email as I was trying 
what you requested, and now Grrrr...



-- 
---

       Regards,
    
       Rod Smart
       0417 513 286