Project

General

Profile

Actions

Support #6780

closed

Suricat 7.0.3 not starting

Added by JP Pozzi 2 months ago. Updated about 2 months ago.

Status:
Closed
Priority:
Normal
Assignee:
Affected Versions:
Label:

Description

Hello,
I was using Suricata 7.0.2 and I compile today 7.0.3, that new version won't start with a message :
suricata: symbol lookup error: suricata: undefined symbol: htp_connp_tx_freed
I compile the new version with the same script as 7.0.2.
I join :
- The compilation LOG
- The install log
Regards
JP P


Files

SURI-7.0.3.LOG (118 KB) SURI-7.0.3.LOG Log compile JP Pozzi, 02/14/2024 03:25 PM
INSTALL.LOG (15.6 KB) INSTALL.LOG Log install JP Pozzi, 02/14/2024 03:25 PM
Actions #1

Updated by Victor Julien 2 months ago

  • Tracker changed from Bug to Support
  • Priority changed from High to Normal
  • Target version deleted (TBD)

Libhtp 0.5.46 is required, the missing symbol means the correct version isn't installed or an older libhtp is also still installed and is used for some reason. You can use ldd to find the path of the libhtp library files in use.

Actions #2

Updated by JP Pozzi 2 months ago

Hello,
The "good" version seems to be installed in :
/usr/src/PGM/BUILD/suricata-7.0.3/libhtp
cat VERSION
  1. This file is intended to be sourced by sh
    PKG_VERSION=0.5.46

Regards

JP P

Actions #3

Updated by JP Pozzi about 2 months ago

Hello,
I look in the libhtp code and I found a reference to the symbol "htp_connp_tx_freed".
The 7.0.3 version works on one test machine but is KO on the main machine.
On my main machine i didn't find "htp_conn_tx_freed" in the compiled lib with "strings".
I try to recompile the lib only and I find the symbol in the library.
After searching I saw that the lib was installed in /usr/local/lib and an older version exists in /usr/lib and was used, that was the problem.
AFter recompiling it installs OK, but I do not know why that lib was copied to /usr/local/lib instead on /usr/lib ?
I used the same script on the two machines.

There is not any problem more with the 7.0.3 ... Thanks

Regards
JP P

Actions #4

Updated by Jason Ish about 2 months ago

  • Status changed from New to Closed
Actions

Also available in: Atom PDF