Snort Message - WARNING: No preprocessors configured for policy 0

Question

I have installed and configured snort 2.9.7.2 and it is running without a problem. However, my question is: what does the following warning mean?

"No preprocessors configured for policy 0"

This message shows when I run the command:

snort -v

score 10 · Answer 1 · edited Jul 05 '21 at 13:47

10

This message indicates that no snort preprocessor is loaded. In order to get rid of this warning, please use the following command:

snort -v -c /etc/snort/snort.conf

Please make sure that the configuration file /etc/snort/snort.conf is present and preprocessors are enabled in the configuration file.

edited Jul 05 '21 at 13:47

galoget

answered Dec 31 '15 at 07:43

Arun Kaushal

After doing this I get this message ERROR: ../rules/app-detect.rules(33) Unknown ClassType: web-application-attack Fatal Error, Quitting.. – Shawn Sim Jun 01 '17 at 01:08
Anyone could be forgiven for thinking that path would be loaded by default when omitted. – MrYellow Dec 02 '17 at 23:33
In 2019, Snort seems to install incorrectly on Windows 10. I get various error messages trying to follow the documentation examples. One message includes Linux pathnames, which don't exist on Windows. There is no point in including details here if Snort is no longer a viable tool or is not really supported for Windows. Can Snort be used on a Linux server to reduce the load caused by unauthorized website and email activity? I was trying it out on Windows to evaluate it for use on my standard hosted websites and email. – David Spector Oct 05 '19 at 16:22

score 1 · Answer 2 · edited Jul 05 '21 at 13:47

1

I had the same error:

No preprocessors configured for policy 0

That was because I forgot to unpack all the rules into the proper folders. After unpacking the rules, the error went away.

edited Jul 05 '21 at 13:47

galoget

answered Feb 25 '21 at 16:35

William A

score 0 · Answer 3 · edited Jul 05 '21 at 06:53

0

Check if it is enabled and see if it has any sid or msg with:

snort -A console -c /etc/snort/snort.conf

And check if any of the preprocessors are sending alerts if not you should recompile it.

edited Jul 05 '21 at 06:53

galoget

answered Oct 22 '19 at 06:06

DXH30

score 0 · Answer 4 · edited Jul 06 '21 at 02:29

0

You must enable the snort preprocessors:

snort -v -c /etc/snort/snort.conf

Make sure snort.conf has all your preprocessors enabled.

edited Jul 06 '21 at 02:29

galoget

answered Nov 04 '19 at 19:36

Abdul R Farouk

4 Answers4