I've built Suricata 4.1.4 as a package, and would like to use the magicfile option. As one of the many Suricata dependencies, I have +libmagic and the libraries are on the device under /usr/lib, but no .mgc file is installed.
Looking at the feeds/packages/libs/file/Makefile, it shows defines for installing files into /usr/share/magic but they don't seem to be being called.
Any help is appreciated.
Thanks to @jow, I finally got it figured out.
The library package libmagic installs the libraries, but the the /usr/share/misc/magic file is generated only if the package file is installed.
The magic.mgc file is a compiled version of the /usr/share/misc/magic file and can be compiled by using /usr/bin/file -C -m /usr/share/misc/magic
This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.