SigName unknown

BASE-user
Justin
2009-01-13
2013-06-03
  • Justin

    Justin - 2009-01-13

    I just installed BASE 1.4.1 with snort 2.8.3.1 on a new box running Debian 4 mySQL, and FLoP 1.6.1.  Everything appears to be going to the database fine.  But, when I look in BASE, EVERY alert is listed with "(35) (2) SigName unknown".  If I look in the db, I can see the signature names in the sig_name field in the signature table.  (I'm assuming that's where it's supposed to be stored since it is being stored there)

    Any insight would be greatly appreciated!

     
    • Ken

      Ken - 2009-02-12

      I had a similar issue but I am not sure if it is related or not.  Intially when I was setting up BASE I was getting "Parse error: syntax error, unexpected '{' in /var/www/base/includes/base_signature.inc.php on line 463".  I ran across a post (https://sourceforge.net/forum/forum.php?thread_id=2208776&forum_id=404428) that showed me how to fix it.  When I looked in BASE every alert had "(2)  SigName unknown".  The only issue was I commented out the below line in /var/www/base/includes/base_signature.inc.php that I wasn't suppose to.    Not sure if you ran across the same issue or not.

      Line 465                  $buf1 = BuildSigLookup($sig_name, $style);

       
    • Constantine Korobov

      Got same problem. Solved with installation of Base 1.4.0

       

Log in to post a comment.

Get latest updates about Open Source Projects, Conferences and News.

Sign up for the SourceForge newsletter:





No, thanks