Thanks Y.  I did what you said, then ran into whitelist/blacklist 507 errors.  So I commented out...

# If you are using reputation preprocessor set these
#var WHITE_LIST_PATH /etc/snort/rules
#var BLACK_LIST_PATH /etc/snort/rules

AND

# Reputation preprocessor. For more information see README.reputation
preprocessor reputation: \
   memcap 500, \
   priority whitelist, \
   nested_ip inner, \
#   whitelist $WHITE_LIST_PATH/white_list.rules, \
#   blacklist $BLACK_LIST_PATH/black_list.rules 


Then I'm back in the same boat with the same error that I had before related to the web-application-attack.

Thanks for any ideas on this one,


On Sat, Aug 30, 2014 at 2:27 AM, Y M <snort@outlook.com> wrote:
Date: Fri, 29 Aug 2014 17:29:43 -0500
From: mr10001@gmail.com
To: snort-users@lists.sourceforge.net
Subject: [Snort-users] Unknown ClassType: web-application-attack

Hey Guys,

Been pounding the pig all day and still have a few kinks to work out.

I've installed snort and pulledpork via brew on OSX.  With this groups help, I was able to get pulledpork functioning.  Now I'm getting the following error when trying to run snort with this command...
sudo snort -c /etc/snort/snort.conf -l /var/log/snort/
ERROR:
Initializing rule chains...
ERROR: /etc/snort/rules/app-detect.rules(33) Unknown ClassType: web-application-attack

Fatal Error, Quitting..


Any ideas on what I'm missing?

* Most probably, the web-application-attack is missing from the classification.config file.

I did comment out the following (because I was getting a different error around black lists):

# Reputation preprocessor. For more information see README.reputation
preprocessor reputation: \
#   memcap 500, \
#   priority whitelist, \
#   nested_ip inner, \
#   whitelist $WHITE_LIST_PATH/white_list.rules, \
#   blacklist $BLACK_LIST_PATH/black_list.rules 

Thanks for any thoughts,

* Download up-to-date configuration files and replace the existing/older ones. You can download them from here: https://www.snort.org/configurations

--
M., CISSP, GCFE, GCFA

To disagree leads to study, to study leads to understanding, to understand is to appreciate, to appreciate is to love. So maybe I’ll end up loving your theory. -John Wheeler

------------------------------------------------------------------------------ Slashdot TV. Video for Nerds. Stuff that matters. http://tv.slashdot.org/
_______________________________________________ Snort-users mailing list Snort-users@lists.sourceforge.net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users Please visit http://blog.snort.org to stay current on all the latest Snort news!



--
Matt M., CISSP, GCFE, GCFA

To disagree leads to study, to study leads to understanding, to understand is to appreciate, to appreciate is to love. So maybe I’ll end up loving your theory. -John Wheeler