Suricata

Which Suricata version are you trying to install and what is your configure line?

This option looks suspicious '--with-libhtp-includes=/usr/local/include/htp/'. Did you mean '--with-libhtp-includes=/usr/local/include/'? This '--with-libhtp-libraries=/usr/local/lib/' suggests you installed libhtp into /usr/local.

Btw, please use the latest libhtp. 0.5.19 is not the latest.

@Thomas Chan - apologies I missed the provided configure line. Please follow Victor's advices and upgrade to the latest libhtp (and latest suri :) ).

Thanks Peter and Victor for your respond
actually I have libhtp file deployed in /usr/local/lib

lrwxrwxrwx 1 root root      22 Nov 29 13:08 libhtp-0.5.19.so.1 -> libhtp-0.5.19.so.1.0.0
-rwxr-xr-x 1 root root  479998 Nov 29 13:08 libhtp-0.5.19.so.1.0.0
lrwxrwxrwx 1 root root      22 Nov 29 13:59 libhtp-0.5.21.so.1 -> libhtp-0.5.21.so.1.0.0
-rwxr-xr-x 1 root root  492148 Nov 29 13:59 libhtp-0.5.21.so.1.0.0
lrwxrwxrwx 1 root root      22 Nov 29 14:02 libhtp-0.5.23.so.1 -> libhtp-0.5.23.so.1.0.0
-rwxr-xr-x 1 root root  492244 Nov 29 14:02 libhtp-0.5.23.so.1.0.0
-rw-r--r-- 1 root root 1030878 Nov 29 14:02 libhtp.a
-rwxr-xr-x 1 root root     938 Nov 29 14:02 libhtp.la
lrwxrwxrwx 1 root root      22 Nov 29 14:02 libhtp.so -> libhtp-0.5.23.so.1.0.0
drwxr-xr-x 2 root root    4096 Nov 29 14:02 pkgconfig

and those htp*.h file located in folder /usr/local/include/htp

-rw-r--r-- 1 root root  4161 Nov 29 14:02 bstr_builder.h
-rw-r--r-- 1 root root 18993 Nov 29 14:02 bstr.h
-rw-r--r-- 1 root root  2636 Nov 29 14:02 htp_base64.h
-rw-r--r-- 1 root root 21116 Nov 29 14:02 htp_config.h
-rw-r--r-- 1 root root  7590 Nov 29 14:02 htp_connection_parser.h
-rw-r--r-- 1 root root 11243 Nov 29 14:02 htp_core.h
-rw-r--r-- 1 root root  3025 Nov 29 14:02 htp_decompressors.h
-rw-r--r-- 1 root root 21589 Nov 29 14:02 htp.h
-rw-r--r-- 1 root root  4104 Nov 29 14:02 htp_hooks.h
-rw-r--r-- 1 root root  5846 Nov 29 14:02 htp_list.h
-rw-r--r-- 1 root root 11611 Nov 29 14:02 htp_multipart.h
-rw-r--r-- 1 root root  6254 Nov 29 14:02 htp_table.h
-rw-r--r-- 1 root root 21500 Nov 29 14:02 htp_transaction.h
-rw-r--r-- 1 root root  3879 Nov 29 14:02 htp_urlencoded.h
-rw-r--r-- 1 root root  3663 Nov 29 14:02 htp_utf8_decoder.h
-rw-r--r-- 1 root root  2158 Nov 29 14:02 htp_version.h

as you can see I did try to install libhtp 0.5.23 on my server,
since I got this error ERROR! libhtp was found but it is neither >= 0.5.20, nor the dev 0.5.X.
so I have downgraded my libhtp to below 0.5.20, but I'm still getting the same error by running 0.5.19
so I have a big question on the version of libhtp.

Can you attack the config.log from the suricata build directory?

Can you try adding: PKG_CONFIG_PATH="$PKG_CONFIG_PATH:/usr/local/lib/pkgconfig" ./configure ...

same
[root@suri01 suricata-suricata-3.1.3]# set |grep PKG
PKG_CONFIG_PATH=:/usr/local/lib/pkgconfig

checking for htp_conn_create in -lhtp... yes
checking for LIBHTPMINVERSION... no
checking for LIBHTPDEVVERSION... no

ERROR! libhtp was found but it is neither >= 0.5.20, nor the dev 0.5.X

This error message confuse me, is that means libhtp newer than or equal to 0.5.20 is not support?

It wasn't finding the htp.pc file. From your config.log:

configure:23112: checking for LIBHTPMINVERSION
configure:23119: $PKG_CONFIG --exists --print-errors "htp >= 0.5.20" 
Package htp was not found in the pkg-config search path.
Perhaps you should add the directory containing `htp.pc'
to the PKG_CONFIG_PATH environment variable
No package 'htp' found
configure:23122: $? = 1
configure:23135: $PKG_CONFIG --exists --print-errors "htp >= 0.5.20" 
Package htp was not found in the pkg-config search path.
Perhaps you should add the directory containing `htp.pc'
to the PKG_CONFIG_PATH environment variable
No package 'htp' found
configure:23138: $? = 1
No package 'htp' found
configure:23165: result: no
configure:23180: checking for LIBHTPDEVVERSION
configure:23187: $PKG_CONFIG --exists --print-errors "htp = 0.5.X" 
Package htp was not found in the pkg-config search path.
Perhaps you should add the directory containing `htp.pc'
to the PKG_CONFIG_PATH environment variable
No package 'htp' found
configure:23190: $? = 1
configure:23203: $PKG_CONFIG --exists --print-errors "htp = 0.5.X" 
Package htp was not found in the pkg-config search path.
Perhaps you should add the directory containing `htp.pc'
to the PKG_CONFIG_PATH environment variable
No package 'htp' found
configure:23206: $? = 1
No package 'htp' found
configure:23233: result: no

file is here, I need to add more parameter?

# set |grep PKG
PKG_CONFIG_PATH=:/usr/local/lib/pkgconfig
# ls -l /usr/local/lib/pkgconfig/
total 4
-rw-r--r-- 1 root root 287 Nov 30 16:11 htp.pc

You can test the pkgconfig stuff manually. I have my libhtp installed in /opt/htp-0.5.x

I get the same error you have in the config.log:

$ pkg-config --exists --print-errors "htp >= 0.5.20" 
Package htp was not found in the pkg-config search path.
Perhaps you should add the directory containing `htp.pc'
to the PKG_CONFIG_PATH environment variable
No package 'htp' found

Then I can fix it by specifying the PKG_CONFIG_PATH:

$ PKG_CONFIG_PATH=/opt/htp-0.5.x/lib/pkgconfig pkg-config --exists --print-errors "htp >= 0.5.20" 
$ echo $?
0

Thanks Victor
after I type in the following command in a signle line, all good now.
previously I just config PKG_CONFIG_PATH as a environment var.

PKG_CONFIG_PATH=/usr/local/lib/pkgconfig ./configure --prefix=/app/suricata/ --sysconfdir=/app/suricata/etc/ --localstatedir=/app/suricata/log/ --enable-non-bundled-htp --with-libhtp-includes=/usr/local/include/htp/ --with-libhtp-libraries=/usr/local/lib/ --enable-nfqueue -with-libnetfilter-queue-includes=/usr/include/libnetfilter_queue/ --with-libnetfilter-queue-libraries=/usr/include/libnetfilter_queue/--enable-lua