From cclark at quadrantsec.com Sun Mar 18 18:17:42 2012 From: cclark at quadrantsec.com (Champ Clark III) Date: Sun, 18 Mar 2012 13:17:42 -0400 Subject: [Lognorm] Liblognorm from git on Ubuntu 11.10 Message-ID: <4F6618B6.5050607@quadrantsec.com> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Rainer, I hope things are going well! I was looking to reproduce a compile issue for Sagan, when I ran into this compile error from the git tree. CC liblognorm_la-lognorm.lo CCLD liblognorm.la CC normalizer-normalizer.o CCLD normalizer /usr/lib/libee.so: undefined reference to `pow' /usr/lib/libee.so: undefined reference to `floor' collect2: ld returned 1 exit status Any ideas? - -- - - Champ Clark III (cclark at quadrantsec.com) Quadrant Information Security (http://quadrantsec.com) Key Fingerprint: 2E56 C2EB 1B25 C517 D5BA 2DCF 5E70 B2F8 0381 878A GPG Key ID: 0381878A -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.17 (Darwin) Comment: GPGTools - http://gpgtools.org Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iQEcBAEBAgAGBQJPZhi2AAoJENnmXt7Lmc3KCLAH/1v9E5M7Bv4E+RxkHs2DcY7k 0Q0608+2NPdoxW9zX8zyByLHJA7dO248LMB+t+4ZzrQ0ZH0LytaTPvu6UPgUbIcg pzp7E6izu2ZST1S9FbKELSpQfKXFaDX99fBzJVp+AZQFUpmVFNk/6TQLCA35+fEa ScHKRnTpZljGTbXFkZB8/WnS8oWr6yQ3j0ejnK0Vd/a7+NfenAS9J/RhZlMc40xO Zd56csXcDO3/b8z97Hgsz257IwiUPhMsf6GD6c52l/IWlZaACbTrd40uBAC+xDNy o6BGaw7DVhUG+UYOE2Z72eJ4IEW2U8KBz1zHU59Wpy2vERQxlfBytVvvSJmtXP4= =TsRo -----END PGP SIGNATURE----- From cclark at quadrantsec.com Sun Mar 18 18:43:22 2012 From: cclark at quadrantsec.com (Champ Clark III) Date: Sun, 18 Mar 2012 13:43:22 -0400 Subject: [Lognorm] Liblognorm from git on Ubuntu 11.10 In-Reply-To: <4F6618B6.5050607@quadrantsec.com> References: <4F6618B6.5050607@quadrantsec.com> Message-ID: <4F661EBA.4030908@quadrantsec.com> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I pulled down the liblognorm "stable" version as well. When Sagan goes to link, it gets: /usr/bin/ld: sagan.o: undefined reference to symbol 'ee_getEventField' /usr/bin/ld: note: 'ee_getEventField' is defined in DSO /usr/lib/libee.so.0 so try adding it to the linker command line /usr/lib/libee.so.0: could not read symbols: Invalid operation On the Sagan mailing list, we've had a couple of people bring this up for Ubuntu 11.10. Any thoughts? Thanks in advance Mr. Rainer :) On 3/18/12 1:17 PM, Champ Clark III wrote: > > Rainer, > > I hope things are going well! > > I was looking to reproduce a compile issue for Sagan, when I ran > into this compile error from the git tree. > > CC liblognorm_la-lognorm.lo CCLD liblognorm.la CC > normalizer-normalizer.o CCLD normalizer /usr/lib/libee.so: > undefined reference to `pow' /usr/lib/libee.so: undefined reference > to `floor' collect2: ld returned 1 exit status > > Any ideas? > > > _______________________________________________ Lognorm mailing > list Lognorm at lists.adiscon.com > http://lists.adiscon.net/mailman/listinfo/lognorm - -- - - Champ Clark III (cclark at quadrantsec.com) Quadrant Information Security (http://quadrantsec.com) Key Fingerprint: 2E56 C2EB 1B25 C517 D5BA 2DCF 5E70 B2F8 0381 878A GPG Key ID: 0381878A -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.17 (Darwin) Comment: GPGTools - http://gpgtools.org Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iQEcBAEBAgAGBQJPZh65AAoJENnmXt7Lmc3KV5gIAJRkHzcaXCUSRsFsounWRr/w W6ZFDhH1IaWI3xCLlyX85PjrdEtJfGUyOmsozFRmJYSxcDmW7wyoKTV1EBCJPFsC oRMINy2CHSDyPLMAa8tYEl2QjVnk+jPL9o8fm7wo3ICAOOEQwcISJjjvRIv/bfMB FaiiVIi/UPTcTanwWjQWB5DMWdCLJE+/IHhyP7rt3JJoL3SAHR6vY824h1AlQ0eo e5MSFR8+nBe8uN4LibVp/nG9dWxhhw/BBAu0uIiTYiMBGd3MAPwYMEkKkKR1YpFN Sn9oamqCBClbbOdcjZ5/XKNnI6/e2bHErpUY67p9SgN3SEpyOXgzTv8Dlcg+Tj0= =jJDk -----END PGP SIGNATURE----- From cclark at quadrantsec.com Sun Mar 18 19:05:11 2012 From: cclark at quadrantsec.com (Champ Clark III) Date: Sun, 18 Mar 2012 14:05:11 -0400 Subject: [Lognorm] Liblognorm from git on Ubuntu 11.10 In-Reply-To: <4F661EBA.4030908@quadrantsec.com> References: <4F6618B6.5050607@quadrantsec.com> <4F661EBA.4030908@quadrantsec.com> Message-ID: <4F6623D7.5040606@quadrantsec.com> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Oh. I should point out, the "stable" I'm referring to is actually from the "apt-get install liblognorm-dev" (Ubuntu 11.10) and was not built by source. The git version (below the "stable") is the only one I tried to build via source under Ubuntu 11.10. On 3/18/12 1:43 PM, Champ Clark III wrote: > I pulled down the liblognorm "stable" version as well. When Sagan > goes to link, it gets: > > /usr/bin/ld: sagan.o: undefined reference to symbol > 'ee_getEventField' /usr/bin/ld: note: 'ee_getEventField' is defined > in DSO /usr/lib/libee.so.0 so try adding it to the linker command > line /usr/lib/libee.so.0: could not read symbols: Invalid > operation > > On the Sagan mailing list, we've had a couple of people bring this > up for Ubuntu 11.10. > > Any thoughts? Thanks in advance Mr. Rainer :) > > > On 3/18/12 1:17 PM, Champ Clark III wrote: > >> Rainer, > >> I hope things are going well! > >> I was looking to reproduce a compile issue for Sagan, when I >> ran into this compile error from the git tree. > >> CC liblognorm_la-lognorm.lo CCLD liblognorm.la CC >> normalizer-normalizer.o CCLD normalizer /usr/lib/libee.so: >> undefined reference to `pow' /usr/lib/libee.so: undefined >> reference to `floor' collect2: ld returned 1 exit status > >> Any ideas? > > >> _______________________________________________ Lognorm mailing >> list Lognorm at lists.adiscon.com >> http://lists.adiscon.net/mailman/listinfo/lognorm > > _______________________________________________ Lognorm mailing > list Lognorm at lists.adiscon.com > http://lists.adiscon.net/mailman/listinfo/lognorm - -- - - Champ Clark III (cclark at quadrantsec.com) Quadrant Information Security (http://quadrantsec.com) Key Fingerprint: 2E56 C2EB 1B25 C517 D5BA 2DCF 5E70 B2F8 0381 878A GPG Key ID: 0381878A -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.17 (Darwin) Comment: GPGTools - http://gpgtools.org Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iQEcBAEBAgAGBQJPZiPXAAoJENnmXt7Lmc3KWSQH/AlZ8BV3l9bDKd8N/b7Ma968 9Tv+4paHKpKkHa2ck7J/aV5zSJXkz1e9q7J2ZaAUmG6T8DAugbCDXvY9lmKxg31d JcFS0BdF5Zwxm820o+etaSV4slv/OGqI+fDOrTvZf30+aAc3AYZPLQwnC60yAHC4 w+QM0qoG//ukw1uI/K7WUdcMa2GILthitTFxazmZx1Jq1gopr5QObuoOAsh5+fGP GYPQcgUvxDXp7XcHKpXo6lfU+U7ydRmJxRrntv+xCBN1wea8W5ytjAl41GlbSRcP qtybL7NhqCxvP8tnr/l3GTDIIQePAMHq1nQ7YJQjw1qfEoLnAuPfDQ0JYMJ0ec8= =eQ/k -----END PGP SIGNATURE----- From rgerhards at hq.adiscon.com Sun Mar 18 20:12:34 2012 From: rgerhards at hq.adiscon.com (Rainer Gerhards) Date: Sun, 18 Mar 2012 20:12:34 +0100 Subject: [Lognorm] Liblognorm from git on Ubuntu 11.10 Message-ID: <001601cd053b$0190f697$100013ac@intern.adiscon.com> Not a full answer (tomorrow), but mat lib is missing. I guess -lmath RainerChamp Clark III hat geschrieben:-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Oh. I should point out, the "stable" I'm referring to is actually from the "apt-get install liblognorm-dev" (Ubuntu 11.10) and was not built by source. The git version (below the "stable") is the only one I tried to build via source under Ubuntu 11.10. On 3/18/12 1:43 PM, Champ Clark III wrote: > I pulled down the liblognorm "stable" version as well. When Sagan > goes to link, it gets: > > /usr/bin/ld: sagan.o: undefined reference to symbol > 'ee_getEventField' /usr/bin/ld: note: 'ee_getEventField' is defined > in DSO /usr/lib/libee.so.0 so try adding it to the linker command > line /usr/lib/libee.so.0: could not read symbols: Invalid > operation > > On the Sagan mailing list, we've had a couple of people bring this > up for Ubuntu 11.10. > > Any thoughts? Thanks in advance Mr. Rainer :) > > > On 3/18/12 1:17 PM, Champ Clark III wrote: > >> Rainer, > >> I hope things are going well! > >> I was looking to reproduce a compile issue for Sagan, when I >> ran into this compile error from the git tree. > >> CC liblognorm_la-lognorm.lo CCLD liblognorm.la CC >> normalizer-normalizer.o CCLD normalizer /usr/lib/libee.so: >> undefined reference to `pow' /usr/lib/libee.so: undefined >> reference to `floor' collect2: ld returned 1 exit status > >> Any ideas? > > >> _______________________________________________ Lognorm mailing >> list Lognorm at lists.adiscon.com >> http://lists.adiscon.net/mailman/listinfo/lognorm > > _______________________________________________ Lognorm mailing > list Lognorm at lists.adiscon.com > http://lists.adiscon.net/mailman/listinfo/lognorm - -- - - Champ Clark III (cclark at quadrantsec.com) Quadrant Information Security (http://quadrantsec.com) Key Fingerprint: 2E56 C2EB 1B25 C517 D5BA 2DCF 5E70 B2F8 0381 878A GPG Key ID: 0381878A -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.17 (Darwin) Comment: GPGTools - http://gpgtools.org Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iQEcBAEBAgAGBQJPZiPXAAoJENnmXt7Lmc3KWSQH/AlZ8BV3l9bDKd8N/b7Ma968 9Tv+4paHKpKkHa2ck7J/aV5zSJXkz1e9q7J2ZaAUmG6T8DAugbCDXvY9lmKxg31d JcFS0BdF5Zwxm820o+etaSV4slv/OGqI+fDOrTvZf30+aAc3AYZPLQwnC60yAHC4 w+QM0qoG//ukw1uI/K7WUdcMa2GILthitTFxazmZx1Jq1gopr5QObuoOAsh5+fGP GYPQcgUvxDXp7XcHKpXo6lfU+U7ydRmJxRrntv+xCBN1wea8W5ytjAl41GlbSRcP qtybL7NhqCxvP8tnr/l3GTDIIQePAMHq1nQ7YJQjw1qfEoLnAuPfDQ0JYMJ0ec8= =eQ/k -----END PGP SIGNATURE----- _______________________________________________ Lognorm mailing list Lognorm at lists.adiscon.com http://lists.adiscon.net/mailman/listinfo/lognorm From cclark at quadrantsec.com Sun Mar 18 20:21:37 2012 From: cclark at quadrantsec.com (Champ Clark III) Date: Sun, 18 Mar 2012 15:21:37 -0400 Subject: [Lognorm] Liblognorm from git on Ubuntu 11.10 In-Reply-To: <001601cd053b$0190f697$100013ac@intern.adiscon.com> References: <001601cd053b$0190f697$100013ac@intern.adiscon.com> Message-ID: <4F6635C1.7010509@quadrantsec.com> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 No rush. Wouldn't that be -lm for libm (math)? That's installed and I can link with it. On 3/18/12 3:12 PM, Rainer Gerhards wrote: > Not a full answer (tomorrow), but mat lib is missing. I guess -lmath > > RainerChamp Clark III hat geschrieben:-----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > Oh. I should point out, the "stable" I'm referring to is actually > from the "apt-get install liblognorm-dev" (Ubuntu 11.10) and was not > built by source. > > The git version (below the "stable") is the only one I tried to build > via source under Ubuntu 11.10. > > > On 3/18/12 1:43 PM, Champ Clark III wrote: >> I pulled down the liblognorm "stable" version as well. When Sagan >> goes to link, it gets: >> >> /usr/bin/ld: sagan.o: undefined reference to symbol >> 'ee_getEventField' /usr/bin/ld: note: 'ee_getEventField' is defined >> in DSO /usr/lib/libee.so.0 so try adding it to the linker command >> line /usr/lib/libee.so.0: could not read symbols: Invalid >> operation >> >> On the Sagan mailing list, we've had a couple of people bring this >> up for Ubuntu 11.10. >> >> Any thoughts? Thanks in advance Mr. Rainer :) >> >> >> On 3/18/12 1:17 PM, Champ Clark III wrote: >> >>> Rainer, >> >>> I hope things are going well! >> >>> I was looking to reproduce a compile issue for Sagan, when I >>> ran into this compile error from the git tree. >> >>> CC liblognorm_la-lognorm.lo CCLD liblognorm.la CC >>> normalizer-normalizer.o CCLD normalizer /usr/lib/libee.so: >>> undefined reference to `pow' /usr/lib/libee.so: undefined >>> reference to `floor' collect2: ld returned 1 exit status >> >>> Any ideas? >> >> >>> _______________________________________________ Lognorm mailing >>> list Lognorm at lists.adiscon.com >>> http://lists.adiscon.net/mailman/listinfo/lognorm >> >> _______________________________________________ Lognorm mailing >> list Lognorm at lists.adiscon.com >> http://lists.adiscon.net/mailman/listinfo/lognorm > > - -- > - - Champ Clark III (cclark at quadrantsec.com) > Quadrant Information Security (http://quadrantsec.com) > Key Fingerprint: 2E56 C2EB 1B25 C517 D5BA 2DCF 5E70 B2F8 0381 878A > GPG Key ID: 0381878A > -----BEGIN PGP SIGNATURE----- > Version: GnuPG/MacGPG2 v2.0.17 (Darwin) > Comment: GPGTools - http://gpgtools.org > Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ > > iQEcBAEBAgAGBQJPZiPXAAoJENnmXt7Lmc3KWSQH/AlZ8BV3l9bDKd8N/b7Ma968 > 9Tv+4paHKpKkHa2ck7J/aV5zSJXkz1e9q7J2ZaAUmG6T8DAugbCDXvY9lmKxg31d > JcFS0BdF5Zwxm820o+etaSV4slv/OGqI+fDOrTvZf30+aAc3AYZPLQwnC60yAHC4 > w+QM0qoG//ukw1uI/K7WUdcMa2GILthitTFxazmZx1Jq1gopr5QObuoOAsh5+fGP > GYPQcgUvxDXp7XcHKpXo6lfU+U7ydRmJxRrntv+xCBN1wea8W5ytjAl41GlbSRcP > qtybL7NhqCxvP8tnr/l3GTDIIQePAMHq1nQ7YJQjw1qfEoLnAuPfDQ0JYMJ0ec8= > =eQ/k > -----END PGP SIGNATURE----- > _______________________________________________ > Lognorm mailing list > Lognorm at lists.adiscon.com > http://lists.adiscon.net/mailman/listinfo/lognorm > _______________________________________________ > Lognorm mailing list > Lognorm at lists.adiscon.com > http://lists.adiscon.net/mailman/listinfo/lognorm - -- - - Champ Clark III (cclark at quadrantsec.com) Quadrant Information Security (http://quadrantsec.com) Key Fingerprint: 2E56 C2EB 1B25 C517 D5BA 2DCF 5E70 B2F8 0381 878A GPG Key ID: 0381878A -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.17 (Darwin) Comment: GPGTools - http://gpgtools.org Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iQEcBAEBAgAGBQJPZjXBAAoJENnmXt7Lmc3KKQQH/RH3EH8PG6EjXpgToxzyp7wD djvwJt7/93hXI01Ek4ttX0Tk4K0ndtwdwK3BERk4VpQcHzNa2zWHRJ4SlrPb8xrU B6QxA7dO5CZHZOmPANz+Q9mRcSsmJ+aAJe3D16Cue0WqduvKKYCXn8N+vIrfupMF PRiKtgka9/L3RqsfJ3CTZNDk/F/RKCdJMfwDu/OtmaJcufg8fKz2XgXyFQJV1BTP eeRYP53CpRxiYgVA7G+ZD09HWvxuGuBMxv/yfdi5CJR0i00eVUANgAnS+HpNahbF 5QEaqVGP3eUuyDAlTva4PrYwB0ZEUhGWzSnAkimyB7Du0R/j6w/htwdf8AgAZYU= =c42v -----END PGP SIGNATURE----- From rgerhards at hq.adiscon.com Sun Mar 18 20:47:37 2012 From: rgerhards at hq.adiscon.com (Rainer Gerhards) Date: Sun, 18 Mar 2012 20:47:37 +0100 Subject: [Lognorm] Liblognorm from git on Ubuntu 11.10 Message-ID: <001701cd053f$e67ef7b7$100013ac@intern.adiscon.com> Jupp. You are right with -lm Will check tomorrow ;-) Rainer Champ Clark III hat geschrieben:-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 No rush. Wouldn't that be -lm for libm (math)? That's installed and I can link with it. On 3/18/12 3:12 PM, Rainer Gerhards wrote: > Not a full answer (tomorrow), but mat lib is missing. I guess -lmath > > RainerChamp Clark III hat geschrieben:-----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > Oh. I should point out, the "stable" I'm referring to is actually > from the "apt-get install liblognorm-dev" (Ubuntu 11.10) and was not > built by source. > > The git version (below the "stable") is the only one I tried to build > via source under Ubuntu 11.10. > > > On 3/18/12 1:43 PM, Champ Clark III wrote: >> I pulled down the liblognorm "stable" version as well. When Sagan >> goes to link, it gets: >> >> /usr/bin/ld: sagan.o: undefined reference to symbol >> 'ee_getEventField' /usr/bin/ld: note: 'ee_getEventField' is defined >> in DSO /usr/lib/libee.so.0 so try adding it to the linker command >> line /usr/lib/libee.so.0: could not read symbols: Invalid >> operation >> >> On the Sagan mailing list, we've had a couple of people bring this >> up for Ubuntu 11.10. >> >> Any thoughts? Thanks in advance Mr. Rainer :) >> >> >> On 3/18/12 1:17 PM, Champ Clark III wrote: >> >>> Rainer, >> >>> I hope things are going well! >> >>> I was looking to reproduce a compile issue for Sagan, when I >>> ran into this compile error from the git tree. >> >>> CC liblognorm_la-lognorm.lo CCLD liblognorm.la CC >>> normalizer-normalizer.o CCLD normalizer /usr/lib/libee.so: >>> undefined reference to `pow' /usr/lib/libee.so: undefined >>> reference to `floor' collect2: ld returned 1 exit status >> >>> Any ideas? >> >> >>> _______________________________________________ Lognorm mailing >>> list Lognorm at lists.adiscon.com >>> http://lists.adiscon.net/mailman/listinfo/lognorm >> >> _______________________________________________ Lognorm mailing >> list Lognorm at lists.adiscon.com >> http://lists.adiscon.net/mailman/listinfo/lognorm > > - -- > - - Champ Clark III (cclark at quadrantsec.com) > Quadrant Information Security (http://quadrantsec.com) > Key Fingerprint: 2E56 C2EB 1B25 C517 D5BA 2DCF 5E70 B2F8 0381 878A > GPG Key ID: 0381878A > -----BEGIN PGP SIGNATURE----- > Version: GnuPG/MacGPG2 v2.0.17 (Darwin) > Comment: GPGTools - http://gpgtools.org > Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ > > iQEcBAEBAgAGBQJPZiPXAAoJENnmXt7Lmc3KWSQH/AlZ8BV3l9bDKd8N/b7Ma968 > 9Tv+4paHKpKkHa2ck7J/aV5zSJXkz1e9q7J2ZaAUmG6T8DAugbCDXvY9lmKxg31d > JcFS0BdF5Zwxm820o+etaSV4slv/OGqI+fDOrTvZf30+aAc3AYZPLQwnC60yAHC4 > w+QM0qoG//ukw1uI/K7WUdcMa2GILthitTFxazmZx1Jq1gopr5QObuoOAsh5+fGP > GYPQcgUvxDXp7XcHKpXo6lfU+U7ydRmJxRrntv+xCBN1wea8W5ytjAl41GlbSRcP > qtybL7NhqCxvP8tnr/l3GTDIIQePAMHq1nQ7YJQjw1qfEoLnAuPfDQ0JYMJ0ec8= > =eQ/k > -----END PGP SIGNATURE----- > _______________________________________________ > Lognorm mailing list > Lognorm at lists.adiscon.com > http://lists.adiscon.net/mailman/listinfo/lognorm > _______________________________________________ > Lognorm mailing list > Lognorm at lists.adiscon.com > http://lists.adiscon.net/mailman/listinfo/lognorm - -- - - Champ Clark III (cclark at quadrantsec.com) Quadrant Information Security (http://quadrantsec.com) Key Fingerprint: 2E56 C2EB 1B25 C517 D5BA 2DCF 5E70 B2F8 0381 878A GPG Key ID: 0381878A -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.17 (Darwin) Comment: GPGTools - http://gpgtools.org Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iQEcBAEBAgAGBQJPZjXBAAoJENnmXt7Lmc3KKQQH/RH3EH8PG6EjXpgToxzyp7wD djvwJt7/93hXI01Ek4ttX0Tk4K0ndtwdwK3BERk4VpQcHzNa2zWHRJ4SlrPb8xrU B6QxA7dO5CZHZOmPANz+Q9mRcSsmJ+aAJe3D16Cue0WqduvKKYCXn8N+vIrfupMF PRiKtgka9/L3RqsfJ3CTZNDk/F/RKCdJMfwDu/OtmaJcufg8fKz2XgXyFQJV1BTP eeRYP53CpRxiYgVA7G+ZD09HWvxuGuBMxv/yfdi5CJR0i00eVUANgAnS+HpNahbF 5QEaqVGP3eUuyDAlTva4PrYwB0ZEUhGWzSnAkimyB7Du0R/j6w/htwdf8AgAZYU= =c42v -----END PGP SIGNATURE----- _______________________________________________ Lognorm mailing list Lognorm at lists.adiscon.com http://lists.adiscon.net/mailman/listinfo/lognorm From rgerhards at hq.adiscon.com Mon Mar 19 11:54:58 2012 From: rgerhards at hq.adiscon.com (Rainer Gerhards) Date: Mon, 19 Mar 2012 11:54:58 +0100 Subject: [Lognorm] Liblognorm from git on Ubuntu 11.10 In-Reply-To: <4F6623D7.5040606@quadrantsec.com> References: <4F6618B6.5050607@quadrantsec.com><4F661EBA.4030908@quadrantsec.com> <4F6623D7.5040606@quadrantsec.com> Message-ID: <9B6E2A8877C38245BFB15CC491A11DA7281AA4@GRFEXC.intern.adiscon.com> > -----Original Message----- > From: lognorm-bounces at lists.adiscon.com [mailto:lognorm- > bounces at lists.adiscon.com] On Behalf Of Champ Clark III > Sent: Sunday, March 18, 2012 7:05 PM > To: lognorm; sagan-users at googlegroups.com > Subject: Re: [Lognorm] Liblognorm from git on Ubuntu 11.10 > > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > Oh. I should point out, the "stable" I'm referring to is actually > from the "apt-get install liblognorm-dev" (Ubuntu 11.10) and was not > built by source. > > The git version (below the "stable") is the only one I tried to build > via source under Ubuntu 11.10. As far as I can see, this version is simply too old. It is 0.3.0 and I think 0.3.1 is needed for this version (unfortunately I did not document that well...). Rainer > > > On 3/18/12 1:43 PM, Champ Clark III wrote: > > I pulled down the liblognorm "stable" version as well. When Sagan > > goes to link, it gets: > > > > /usr/bin/ld: sagan.o: undefined reference to symbol > > 'ee_getEventField' /usr/bin/ld: note: 'ee_getEventField' is defined > > in DSO /usr/lib/libee.so.0 so try adding it to the linker command > > line /usr/lib/libee.so.0: could not read symbols: Invalid > > operation > > > > On the Sagan mailing list, we've had a couple of people bring this > > up for Ubuntu 11.10. > > > > Any thoughts? Thanks in advance Mr. Rainer :) > > > > > > On 3/18/12 1:17 PM, Champ Clark III wrote: > > > >> Rainer, > > > >> I hope things are going well! > > > >> I was looking to reproduce a compile issue for Sagan, when I > >> ran into this compile error from the git tree. > > > >> CC liblognorm_la-lognorm.lo CCLD liblognorm.la CC > >> normalizer-normalizer.o CCLD normalizer /usr/lib/libee.so: > >> undefined reference to `pow' /usr/lib/libee.so: undefined > >> reference to `floor' collect2: ld returned 1 exit status > > > >> Any ideas? > > > > > >> _______________________________________________ Lognorm mailing > >> list Lognorm at lists.adiscon.com > >> http://lists.adiscon.net/mailman/listinfo/lognorm > > > > _______________________________________________ Lognorm mailing > > list Lognorm at lists.adiscon.com > > http://lists.adiscon.net/mailman/listinfo/lognorm > > - -- > - - Champ Clark III (cclark at quadrantsec.com) > Quadrant Information Security (http://quadrantsec.com) > Key Fingerprint: 2E56 C2EB 1B25 C517 D5BA 2DCF 5E70 B2F8 0381 878A > GPG Key ID: 0381878A > -----BEGIN PGP SIGNATURE----- > Version: GnuPG/MacGPG2 v2.0.17 (Darwin) > Comment: GPGTools - http://gpgtools.org > Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ > > iQEcBAEBAgAGBQJPZiPXAAoJENnmXt7Lmc3KWSQH/AlZ8BV3l9bDKd8N/b7Ma968 > 9Tv+4paHKpKkHa2ck7J/aV5zSJXkz1e9q7J2ZaAUmG6T8DAugbCDXvY9lmKxg31d > JcFS0BdF5Zwxm820o+etaSV4slv/OGqI+fDOrTvZf30+aAc3AYZPLQwnC60yAHC4 > w+QM0qoG//ukw1uI/K7WUdcMa2GILthitTFxazmZx1Jq1gopr5QObuoOAsh5+fGP > GYPQcgUvxDXp7XcHKpXo6lfU+U7ydRmJxRrntv+xCBN1wea8W5ytjAl41GlbSRcP > qtybL7NhqCxvP8tnr/l3GTDIIQePAMHq1nQ7YJQjw1qfEoLnAuPfDQ0JYMJ0ec8= > =eQ/k > -----END PGP SIGNATURE----- > _______________________________________________ > Lognorm mailing list > Lognorm at lists.adiscon.com > http://lists.adiscon.net/mailman/listinfo/lognorm From rgerhards at hq.adiscon.com Mon Mar 19 12:06:05 2012 From: rgerhards at hq.adiscon.com (Rainer Gerhards) Date: Mon, 19 Mar 2012 12:06:05 +0100 Subject: [Lognorm] Liblognorm from git on Ubuntu 11.10 In-Reply-To: <001701cd053f$e67ef7b7$100013ac@intern.adiscon.com> References: <001701cd053f$e67ef7b7$100013ac@intern.adiscon.com> Message-ID: <9B6E2A8877C38245BFB15CC491A11DA7281AA5@GRFEXC.intern.adiscon.com> Bug ;) since I included cJSON, the math lib is needed (I'll probably try to relax this later, seems not be to hard to do). So far, I have added -lm to the pkgconfig linker options. Now in git. Thanks, Rainer > -----Original Message----- > From: lognorm-bounces at lists.adiscon.com [mailto:lognorm- > bounces at lists.adiscon.com] On Behalf Of Rainer Gerhards > Sent: Sunday, March 18, 2012 8:48 PM > To: lognorm at lists.adiscon.com > Subject: Re: [Lognorm] Liblognorm from git on Ubuntu 11.10 > > Jupp. You are right with -lm > Will check tomorrow ;-) > > Rainer > > Champ Clark III hat geschrieben:-----BEGIN PGP > SIGNED MESSAGE----- > Hash: SHA1 > > No rush. Wouldn't that be -lm for libm (math)? That's installed and I > can link with it. > > On 3/18/12 3:12 PM, Rainer Gerhards wrote: > > Not a full answer (tomorrow), but mat lib is missing. I guess -lmath > > > > RainerChamp Clark III hat geschrieben:----- > BEGIN PGP SIGNED MESSAGE----- > > Hash: SHA1 > > > > Oh. I should point out, the "stable" I'm referring to is actually > > from the "apt-get install liblognorm-dev" (Ubuntu 11.10) and was not > > built by source. > > > > The git version (below the "stable") is the only one I tried to build > > via source under Ubuntu 11.10. > > > > > > On 3/18/12 1:43 PM, Champ Clark III wrote: > >> I pulled down the liblognorm "stable" version as well. When Sagan > >> goes to link, it gets: > >> > >> /usr/bin/ld: sagan.o: undefined reference to symbol > >> 'ee_getEventField' /usr/bin/ld: note: 'ee_getEventField' is defined > >> in DSO /usr/lib/libee.so.0 so try adding it to the linker command > >> line /usr/lib/libee.so.0: could not read symbols: Invalid > >> operation > >> > >> On the Sagan mailing list, we've had a couple of people bring this > >> up for Ubuntu 11.10. > >> > >> Any thoughts? Thanks in advance Mr. Rainer :) > >> > >> > >> On 3/18/12 1:17 PM, Champ Clark III wrote: > >> > >>> Rainer, > >> > >>> I hope things are going well! > >> > >>> I was looking to reproduce a compile issue for Sagan, when I > >>> ran into this compile error from the git tree. > >> > >>> CC liblognorm_la-lognorm.lo CCLD liblognorm.la CC > >>> normalizer-normalizer.o CCLD normalizer /usr/lib/libee.so: > >>> undefined reference to `pow' /usr/lib/libee.so: undefined > >>> reference to `floor' collect2: ld returned 1 exit status > >> > >>> Any ideas? > >> > >> > >>> _______________________________________________ Lognorm mailing > >>> list Lognorm at lists.adiscon.com > >>> http://lists.adiscon.net/mailman/listinfo/lognorm > >> > >> _______________________________________________ Lognorm mailing > >> list Lognorm at lists.adiscon.com > >> http://lists.adiscon.net/mailman/listinfo/lognorm > > > > - -- > > - - Champ Clark III (cclark at quadrantsec.com) > > Quadrant Information Security (http://quadrantsec.com) > > Key Fingerprint: 2E56 C2EB 1B25 C517 D5BA 2DCF 5E70 B2F8 0381 878A > > GPG Key ID: 0381878A > > -----BEGIN PGP SIGNATURE----- > > Version: GnuPG/MacGPG2 v2.0.17 (Darwin) > > Comment: GPGTools - http://gpgtools.org > > Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ > > > > iQEcBAEBAgAGBQJPZiPXAAoJENnmXt7Lmc3KWSQH/AlZ8BV3l9bDKd8N/b7Ma968 > > 9Tv+4paHKpKkHa2ck7J/aV5zSJXkz1e9q7J2ZaAUmG6T8DAugbCDXvY9lmKxg31d > > JcFS0BdF5Zwxm820o+etaSV4slv/OGqI+fDOrTvZf30+aAc3AYZPLQwnC60yAHC4 > > w+QM0qoG//ukw1uI/K7WUdcMa2GILthitTFxazmZx1Jq1gopr5QObuoOAsh5+fGP > > GYPQcgUvxDXp7XcHKpXo6lfU+U7ydRmJxRrntv+xCBN1wea8W5ytjAl41GlbSRcP > > qtybL7NhqCxvP8tnr/l3GTDIIQePAMHq1nQ7YJQjw1qfEoLnAuPfDQ0JYMJ0ec8= > > =eQ/k > > -----END PGP SIGNATURE----- > > _______________________________________________ > > Lognorm mailing list > > Lognorm at lists.adiscon.com > > http://lists.adiscon.net/mailman/listinfo/lognorm > > _______________________________________________ > > Lognorm mailing list > > Lognorm at lists.adiscon.com > > http://lists.adiscon.net/mailman/listinfo/lognorm > > > - -- > - - Champ Clark III (cclark at quadrantsec.com) > Quadrant Information Security (http://quadrantsec.com) > Key Fingerprint: 2E56 C2EB 1B25 C517 D5BA 2DCF 5E70 B2F8 0381 878A > GPG Key ID: 0381878A > -----BEGIN PGP SIGNATURE----- > Version: GnuPG/MacGPG2 v2.0.17 (Darwin) > Comment: GPGTools - http://gpgtools.org > Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ > > iQEcBAEBAgAGBQJPZjXBAAoJENnmXt7Lmc3KKQQH/RH3EH8PG6EjXpgToxzyp7wD > djvwJt7/93hXI01Ek4ttX0Tk4K0ndtwdwK3BERk4VpQcHzNa2zWHRJ4SlrPb8xrU > B6QxA7dO5CZHZOmPANz+Q9mRcSsmJ+aAJe3D16Cue0WqduvKKYCXn8N+vIrfupMF > PRiKtgka9/L3RqsfJ3CTZNDk/F/RKCdJMfwDu/OtmaJcufg8fKz2XgXyFQJV1BTP > eeRYP53CpRxiYgVA7G+ZD09HWvxuGuBMxv/yfdi5CJR0i00eVUANgAnS+HpNahbF > 5QEaqVGP3eUuyDAlTva4PrYwB0ZEUhGWzSnAkimyB7Du0R/j6w/htwdf8AgAZYU= > =c42v > -----END PGP SIGNATURE----- > _______________________________________________ > Lognorm mailing list > Lognorm at lists.adiscon.com > http://lists.adiscon.net/mailman/listinfo/lognorm > _______________________________________________ > Lognorm mailing list > Lognorm at lists.adiscon.com > http://lists.adiscon.net/mailman/listinfo/lognorm From gdriggs at gmail.com Mon Mar 19 19:37:32 2012 From: gdriggs at gmail.com (Gary) Date: Mon, 19 Mar 2012 11:37:32 -0700 Subject: [Lognorm] libee 0.4.0 compilation problems on Centos 5.8 Message-ID: This is my target platform because that's currently collecting all our syslogs for splunk (and eventually sending them to sagan as well if I can get past this hurdle). I've compiled libestr and installed it in /usr/local. The configuration of libee seems to go well. $ LIBESTR_CFLAGS=-I/usr/local/include LIBESTR_LIBS=-L/usr/local/lib ./configure checking for a BSD-compatible install... /usr/bin/install -c checking whether build environment is sane... yes checking for a thread-safe mkdir -p... /bin/mkdir -p checking for gawk... gawk checking whether make sets $(MAKE)... yes checking for gcc... gcc checking whether the C compiler works... yes checking for C compiler default output file name... a.out checking for suffix of executables... checking whether we are cross compiling... no checking for suffix of object files... o checking whether we are using the GNU C compiler... yes checking whether gcc accepts -g... yes checking for gcc option to accept ISO C89... none needed checking for style of include used by make... GNU checking dependency style of gcc... gcc3 checking whether gcc and cc understand -c and -o together... yes checking build system type... x86_64-unknown-linux-gnu checking host system type... x86_64-unknown-linux-gnu checking for a sed that does not truncate output... /bin/sed checking for grep that handles long lines and -e... /bin/grep checking for egrep... /bin/grep -E checking for fgrep... /bin/grep -F checking for ld used by gcc... /usr/bin/ld checking if the linker (/usr/bin/ld) is GNU ld... yes checking for BSD- or MS-compatible name lister (nm)... /usr/bin/nm -B checking the name lister (/usr/bin/nm -B) interface... BSD nm checking whether ln -s works... yes checking the maximum length of command line arguments... 98304 checking whether the shell understands some XSI constructs... yes checking whether the shell understands "+="... yes checking for /usr/bin/ld option to reload object files... -r checking for objdump... objdump checking how to recognize dependent libraries... pass_all checking for ar... ar checking for strip... strip checking for ranlib... ranlib checking command to parse /usr/bin/nm -B output from gcc object... ok checking how to run the C preprocessor... gcc -E checking for ANSI C header files... yes checking for sys/types.h... yes checking for sys/stat.h... yes checking for stdlib.h... yes checking for string.h... yes checking for memory.h... yes checking for strings.h... yes checking for inttypes.h... yes checking for stdint.h... yes checking for unistd.h... yes checking for dlfcn.h... yes checking for objdir... .libs checking if gcc supports -fno-rtti -fno-exceptions... no checking for gcc option to produce PIC... -fPIC -DPIC checking if gcc PIC flag -fPIC -DPIC works... yes checking if gcc static flag -static works... yes checking if gcc supports -c -o file.o... yes checking if gcc supports -c -o file.o... (cached) yes checking whether the gcc linker (/usr/bin/ld -m elf_x86_64) supports shared libraries... yes checking whether -lc should be explicitly linked in... no checking dynamic linker characteristics... GNU/Linux ld.so checking how to hardcode library paths into programs... immediate checking whether stripping libraries is possible... yes checking if libtool supports shared libraries... yes checking whether to build shared libraries... yes checking whether to build static libraries... yes checking for stdlib.h... (cached) yes checking for GNU libc compatible malloc... yes checking for pkg-config... /usr/bin/pkg-config checking pkg-config is at least version 0.9.0... yes checking for LIBESTR... yes configure: creating ./config.status config.status: creating Makefile config.status: creating libee.pc config.status: creating src/Makefile config.status: creating include/Makefile config.status: creating include/libee/Makefile config.status: creating tests/Makefile config.status: creating config.h config.status: config.h is unchanged config.status: executing depfiles commands config.status: executing libtool commands ***************************************************** libee will be compiled with the following settings: Debug mode enabled: no Testbench enabled: yes However, compiling is another matter... $ make make all-recursive make[1]: Entering directory `/usr/local/src/libee-0.4.0' Making all in tests make[2]: Entering directory `/usr/local/src/libee-0.4.0/tests' make[2]: Nothing to be done for `all'. make[2]: Leaving directory `/usr/local/src/libee-0.4.0/tests' Making all in include make[2]: Entering directory `/usr/local/src/libee-0.4.0/include' Making all in libee make[3]: Entering directory `/usr/local/src/libee-0.4.0/include/libee' make[3]: Nothing to be done for `all'. make[3]: Leaving directory `/usr/local/src/libee-0.4.0/include/libee' make[3]: Entering directory `/usr/local/src/libee-0.4.0/include' make[3]: Nothing to be done for `all-am'. make[3]: Leaving directory `/usr/local/src/libee-0.4.0/include' make[2]: Leaving directory `/usr/local/src/libee-0.4.0/include' Making all in src make[2]: Entering directory `/usr/local/src/libee-0.4.0/src' CC libee_la-cjson.lo CC libee_la-ctx.lo CC libee_la-tag.lo CC libee_la-event.lo CC libee_la-json_event.lo CC libee_la-value.lo value.c: In function ?ee_newValue?: value.c:37: warning: unused parameter ?ctx? CC libee_la-tagbucket.lo CC libee_la-field.lo field.c: In function ?ee_getFieldValueAsStr?: field.c:182: warning: ?str? may be used uninitialized in this function CC libee_la-fieldbucket.lo CC libee_la-primitivetype.lo CC libee_la-int_dec.lo CC libee_la-json_dec.lo CC libee_la-apache_dec.lo apache_dec.c: In function ?ee_newApache?: apache_dec.c:37: warning: unused parameter ?ctx? apache_dec.c: In function ?ee_apacheAddName?: apache_dec.c:71: warning: unused parameter ?ctx? apache_dec.c: In function ?processLn?: apache_dec.c:205: warning: unused variable ?value? apache_dec.c: In function ?ee_apacheDec?: apache_dec.c:143: warning: ?r? may be used uninitialized in this function CC libee_la-syslog_enc.lo CC libee_la-json_enc.lo CC libee_la-csv_enc.lo csv_enc.c: In function ?ee_AddName?: csv_enc.c:66: warning: unused parameter ?ctx? CC libee_la-xml_enc.lo xml_enc.c: In function ?ee_addValue_XML?: xml_enc.c:60: warning: unused variable ?j? xml_enc.c:59: warning: unused variable ?numbuf? xml_enc.c: At top level: xml_enc.c:40: warning: ?hexdigit? defined but not used CCLD libee.la CC libee_convert-convert.o CCLD libee-convert libee_convert-convert.o: In function `cbNewEvt': /usr/local/src/libee-0.4.0/src/convert.c:109: undefined reference to `es_str2cstr' /usr/local/src/libee-0.4.0/src/convert.c:112: undefined reference to `es_deleteStr' /usr/local/src/libee-0.4.0/src/convert.c:114: undefined reference to `es_str2cstr' /usr/local/src/libee-0.4.0/src/convert.c:117: undefined reference to `es_deleteStr' /usr/local/src/libee-0.4.0/src/convert.c:119: undefined reference to `es_str2cstr' /usr/local/src/libee-0.4.0/src/convert.c:122: undefined reference to `es_deleteStr' /usr/local/src/libee-0.4.0/src/convert.c:86: undefined reference to `es_str2cstr' /usr/local/src/libee-0.4.0/src/convert.c:89: undefined reference to `es_deleteStr' libee_convert-convert.o: In function `cbGetLine': /usr/local/src/libee-0.4.0/src/convert.c:151: undefined reference to `es_newStrFromCStr' /usr/local/src/libee-0.4.0/src/convert.c:156: undefined reference to `es_unescapeStr' libee_convert-convert.o: In function `main': /usr/local/src/libee-0.4.0/src/convert.c:218: undefined reference to `es_newStrFromCStr' /usr/local/src/libee-0.4.0/src/convert.c:221: undefined reference to `es_newStrFromCStr' /usr/local/src/libee-0.4.0/src/convert.c:248: undefined reference to `es_str2cstr' /usr/local/src/libee-0.4.0/src/convert.c:263: undefined reference to `es_str2cstr' ../src/.libs/libee.so: undefined reference to `es_addBuf' ../src/.libs/libee.so: undefined reference to `es_strbufcmp' ../src/.libs/libee.so: undefined reference to `es_newStrFromSubStr' ../src/.libs/libee.so: undefined reference to `es_addChar' ../src/.libs/libee.so: undefined reference to `es_newStr' collect2: ld returned 1 exit status make[2]: *** [libee-convert] Error 1 make[2]: Leaving directory `/usr/local/src/libee-0.4.0/src' make[1]: *** [all-recursive] Error 1 make[1]: Leaving directory `/usr/local/src/libee-0.4.0' make: *** [all] Error 2 Any ideas what I may be doing wrong? much thanks, Gary -------------- next part -------------- An HTML attachment was scrubbed... URL: From cclark at quadrantsec.com Tue Mar 20 21:34:41 2012 From: cclark at quadrantsec.com (Champ Clark III) Date: Tue, 20 Mar 2012 16:34:41 -0400 Subject: [Lognorm] Liblognorm from git on Ubuntu 11.10 # 2 In-Reply-To: <9B6E2A8877C38245BFB15CC491A11DA7281AA5@GRFEXC.intern.adiscon.com> References: <001701cd053f$e67ef7b7$100013ac@intern.adiscon.com> <9B6E2A8877C38245BFB15CC491A11DA7281AA5@GRFEXC.intern.adiscon.com> Message-ID: <4F68E9E1.2070800@quadrantsec.com> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Rainer! Have you every seen this on? Happens on Ubuntu 11.10 as well: gcc -g -O2 -o sagan sagan.o sagan-classifications.o sagan-config.o sagan-lockfile.o sagan-references.o sagan-rules.o sagan-signal.o sagan-key.o sagan-stats.o sagan-strlcat.o sagan-strlcpy.o sagan-usage.o sagan-util.o sagan-plog.o sagan-output.o sagan-processor.o parse-ip.o parse-port.o sagan-alert.o sagan-snort.o sagan-esmtp.o sagan-external.o sagan-prelude.o sagan-unified2.o sagan-twofish.o sagan-snortsam.o -llognorm -lm -lpthread -lpcre /usr/bin/ld: sagan.o: undefined reference to symbol 'ee_initCtx' /usr/bin/ld: note: 'ee_initCtx' is defined in DSO /usr/lib/libee.so.0 so try adding it to the linker command line /usr/lib/libee.so.0: could not read symbols: Invalid operation Is it something to do with the API change? - -- - - Champ Clark III (cclark at quadrantsec.com) Quadrant Information Security (http://quadrantsec.com) Key Fingerprint: 2E56 C2EB 1B25 C517 D5BA 2DCF 5E70 B2F8 0381 878A GPG Key ID: 0381878A -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.17 (Darwin) Comment: GPGTools - http://gpgtools.org Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iQEcBAEBAgAGBQJPaOnhAAoJENnmXt7Lmc3KRM0H/0YAZQfv2gGxV7Q7D8juA7P3 tOKS5cR46d0IZGFFCskYIEZ/49ewqSem5VJg9bHAxVDtHLSRBK50GEjazNbksnx8 ejb4l7RM2rtAtiAt+IPvejkuahK5c16xe7rRgpVjiGkBL2gG+VqQJ/V9dXqEt9LR mEOq1FCGKoHUYnIY/I3isMYLFFsD5fi6TxKt5EQsM6S5PG3tcbv77xKLd1cKqnoc uZsLdFzQd5PEIKEzktfSHq8C+zfS4WlIsfEYPhS9hDh5grY/3mW9WkuBObJegmFf qRfUY5aZawbK4mW4Bha8Qkw9m5vSQjL7UoENyfGIko5tj5nP0ayry5GrtbqLRTo= =K73c -----END PGP SIGNATURE----- From cclark at quadrantsec.com Tue Mar 20 21:40:06 2012 From: cclark at quadrantsec.com (Champ Clark III) Date: Tue, 20 Mar 2012 16:40:06 -0400 Subject: [Lognorm] Liblognorm from git on Ubuntu 11.10 # 2 In-Reply-To: <4F68E9E1.2070800@quadrantsec.com> References: <001701cd053f$e67ef7b7$100013ac@intern.adiscon.com> <9B6E2A8877C38245BFB15CC491A11DA7281AA5@GRFEXC.intern.adiscon.com> <4F68E9E1.2070800@quadrantsec.com> Message-ID: <4F68EB26.8090904@quadrantsec.com> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I use to have Sagan only link with -llognorm, but it appears I now need to link with -lestr, -lee and -llognorm. Is this due to the API change, or have I been missing something. On 3/20/12 4:34 PM, Champ Clark III wrote: > > Rainer! > > Have you every seen this on? Happens on Ubuntu 11.10 as well: > > > gcc -g -O2 -o sagan sagan.o sagan-classifications.o > sagan-config.o sagan-lockfile.o sagan-references.o sagan-rules.o > sagan-signal.o sagan-key.o sagan-stats.o sagan-strlcat.o > sagan-strlcpy.o sagan-usage.o sagan-util.o sagan-plog.o > sagan-output.o sagan-processor.o parse-ip.o parse-port.o > sagan-alert.o sagan-snort.o sagan-esmtp.o sagan-external.o > sagan-prelude.o sagan-unified2.o sagan-twofish.o sagan-snortsam.o > -llognorm -lm -lpthread -lpcre /usr/bin/ld: sagan.o: undefined > reference to symbol 'ee_initCtx' /usr/bin/ld: note: 'ee_initCtx' is > defined in DSO /usr/lib/libee.so.0 so try adding it to the linker > command line /usr/lib/libee.so.0: could not read symbols: Invalid > operation > > Is it something to do with the API change? > > _______________________________________________ Lognorm mailing > list Lognorm at lists.adiscon.com > http://lists.adiscon.net/mailman/listinfo/lognorm - -- - - Champ Clark III (cclark at quadrantsec.com) Quadrant Information Security (http://quadrantsec.com) Key Fingerprint: 2E56 C2EB 1B25 C517 D5BA 2DCF 5E70 B2F8 0381 878A GPG Key ID: 0381878A -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.17 (Darwin) Comment: GPGTools - http://gpgtools.org Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iQEcBAEBAgAGBQJPaOslAAoJENnmXt7Lmc3KXf4H/166lB/jBY/uSocjeVjBnLNN V2ODVZM/UrMXn9e9NYzLIdnYboBFisWITXmqXsoRTcxM4za7vYD7tNjHxPyLbphM NQ8zsrZQC2cMFpGKrHrko1dHyF23LVEEFoHZ5RnNJyU8Nd3TdSPHH+iJpjrvJlc/ xtcQbw+4oOaldBk+MkMaNScS6ba/DbzcJZWNVBZ+ymWgSWO4lsKv3mJnR3R8q6J2 Rkw5ehUyHW7BpVnOrPM6OSW7jkYh9tBZjLNReuIVXdXBAsmlxfslhmy5PYkip6Ca PqpDRVBuf1s3nBPmQVx8jb/8c8xXXtNxARO8ja4imaupHzkfe9fVqbhJHQba6UY= =AJsM -----END PGP SIGNATURE----- From david at lang.hm Tue Mar 20 21:43:59 2012 From: david at lang.hm (david at lang.hm) Date: Tue, 20 Mar 2012 13:43:59 -0700 (PDT) Subject: [Lognorm] Liblognorm from git on Ubuntu 11.10 # 2 In-Reply-To: <4F68EB26.8090904@quadrantsec.com> References: <001701cd053f$e67ef7b7$100013ac@intern.adiscon.com> <9B6E2A8877C38245BFB15CC491A11DA7281AA5@GRFEXC.intern.adiscon.com> <4F68E9E1.2070800@quadrantsec.com> <4F68EB26.8090904@quadrantsec.com> Message-ID: This was an API change. I don't remember exactly when, but I remember it flying by. David Lang On Tue, 20 Mar 2012, Champ Clark III wrote: > I use to have Sagan only link with -llognorm, but it appears I now > need to link with -lestr, -lee and -llognorm. > > Is this due to the API change, or have I been missing something. > > > On 3/20/12 4:34 PM, Champ Clark III wrote: >> >> Rainer! >> >> Have you every seen this on? Happens on Ubuntu 11.10 as well: >> >> >> gcc -g -O2 -o sagan sagan.o sagan-classifications.o >> sagan-config.o sagan-lockfile.o sagan-references.o sagan-rules.o >> sagan-signal.o sagan-key.o sagan-stats.o sagan-strlcat.o >> sagan-strlcpy.o sagan-usage.o sagan-util.o sagan-plog.o >> sagan-output.o sagan-processor.o parse-ip.o parse-port.o >> sagan-alert.o sagan-snort.o sagan-esmtp.o sagan-external.o >> sagan-prelude.o sagan-unified2.o sagan-twofish.o sagan-snortsam.o >> -llognorm -lm -lpthread -lpcre /usr/bin/ld: sagan.o: undefined >> reference to symbol 'ee_initCtx' /usr/bin/ld: note: 'ee_initCtx' is >> defined in DSO /usr/lib/libee.so.0 so try adding it to the linker >> command line /usr/lib/libee.so.0: could not read symbols: Invalid >> operation >> >> Is it something to do with the API change? >> >> _______________________________________________ Lognorm mailing >> list Lognorm at lists.adiscon.com >> http://lists.adiscon.net/mailman/listinfo/lognorm > > - -- > - - Champ Clark III (cclark at quadrantsec.com) > Quadrant Information Security (http://quadrantsec.com) > Key Fingerprint: 2E56 C2EB 1B25 C517 D5BA 2DCF 5E70 B2F8 0381 878A > GPG Key ID: 0381878A > -----BEGIN PGP SIGNATURE----- > Version: GnuPG/MacGPG2 v2.0.17 (Darwin) > Comment: GPGTools - http://gpgtools.org > Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ > > iQEcBAEBAgAGBQJPaOslAAoJENnmXt7Lmc3KXf4H/166lB/jBY/uSocjeVjBnLNN > V2ODVZM/UrMXn9e9NYzLIdnYboBFisWITXmqXsoRTcxM4za7vYD7tNjHxPyLbphM > NQ8zsrZQC2cMFpGKrHrko1dHyF23LVEEFoHZ5RnNJyU8Nd3TdSPHH+iJpjrvJlc/ > xtcQbw+4oOaldBk+MkMaNScS6ba/DbzcJZWNVBZ+ymWgSWO4lsKv3mJnR3R8q6J2 > Rkw5ehUyHW7BpVnOrPM6OSW7jkYh9tBZjLNReuIVXdXBAsmlxfslhmy5PYkip6Ca > PqpDRVBuf1s3nBPmQVx8jb/8c8xXXtNxARO8ja4imaupHzkfe9fVqbhJHQba6UY= > =AJsM > -----END PGP SIGNATURE----- > _______________________________________________ > Lognorm mailing list > Lognorm at lists.adiscon.com > http://lists.adiscon.net/mailman/listinfo/lognorm > From pollux at debian.org Fri Mar 23 21:57:33 2012 From: pollux at debian.org (Pierre Chifflier) Date: Fri, 23 Mar 2012 21:57:33 +0100 Subject: [Lognorm] Liblognorm from git on Ubuntu 11.10 # 2 In-Reply-To: <4F68EB26.8090904@quadrantsec.com> References: <001701cd053f$e67ef7b7$100013ac@intern.adiscon.com> <9B6E2A8877C38245BFB15CC491A11DA7281AA5@GRFEXC.intern.adiscon.com> <4F68E9E1.2070800@quadrantsec.com> <4F68EB26.8090904@quadrantsec.com> Message-ID: <20120323205733.GE4796@mail.wzdftpd.net> On Tue, Mar 20, 2012 at 04:40:06PM -0400, Champ Clark III wrote: > I use to have Sagan only link with -llognorm, but it appears I now > need to link with -lestr, -lee and -llognorm. > > Is this due to the API change, or have I been missing something. Hi, This is caused by changes in DSO linking for indirect links. Here, sagan is linked to liblognorm, and liblognorm is linked to other libs (libee, which in turn is linked to libestr). You now have to list all (direct and indirect) libraries when runningld. This avoids problems when indirect libs changes. Some details here: http://fedoraproject.org/wiki/UnderstandingDSOLinkChange Cheers, Pierre > > > On 3/20/12 4:34 PM, Champ Clark III wrote: > > > > Rainer! > > > > Have you every seen this on? Happens on Ubuntu 11.10 as well: > > > > > > gcc -g -O2 -o sagan sagan.o sagan-classifications.o > > sagan-config.o sagan-lockfile.o sagan-references.o sagan-rules.o > > sagan-signal.o sagan-key.o sagan-stats.o sagan-strlcat.o > > sagan-strlcpy.o sagan-usage.o sagan-util.o sagan-plog.o > > sagan-output.o sagan-processor.o parse-ip.o parse-port.o > > sagan-alert.o sagan-snort.o sagan-esmtp.o sagan-external.o > > sagan-prelude.o sagan-unified2.o sagan-twofish.o sagan-snortsam.o > > -llognorm -lm -lpthread -lpcre /usr/bin/ld: sagan.o: undefined > > reference to symbol 'ee_initCtx' /usr/bin/ld: note: 'ee_initCtx' is > > defined in DSO /usr/lib/libee.so.0 so try adding it to the linker > > command line /usr/lib/libee.so.0: could not read symbols: Invalid > > operation > > > > Is it something to do with the API change? > > -------------- next part -------------- A non-text attachment was scrubbed... Name: not available Type: application/pgp-signature Size: 836 bytes Desc: Digital signature URL: