# $Id: INSTALL,v 1.10 2002/04/21 08:04:14 andreaso Exp $ #

Installation instructions for Oinkmaster v0.4
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

o Put oinkmaster.pl and oinkmaster.conf in some suitable directory/directories.
  It doesn't really matter where.

o Edit the file oinkmaster.conf. There are some options you may want to
  change before even starting. Here you will then also tell Oinkmaster which
  SIDs or files you want to disable or ignore. As you will see, a few things
  are disabled/ignored by default.

  If you already have several rules commented out (or removed) in your current
  rules, you need to add those SIDs to oinkmaster.conf manually, or they  
  will be re-enabled after each update. Note that Oinkmaster will enable 
  all rules by default. Even those that are commented out by default in 
  the rules archive will be enabled, unless -p is specified. Also note that
  possible local modifications you've done inside the official Snort rules
  files will be lost since the files will be overwritten by the new versions
  from the downloaded rules archive after each update.

o Decide in which directory you want to put the new rules. Since you probably
  already have Snort up and running, you should use your existing rules
  directory. If you for example have the official Snort rules stored in
  /snort/snort.org-rules/ you can now update those by running:

  ./oinkmaster.pl -o /snort/snort.org-rules/

  You REALLY should check out the entire README before doing anything though.
  You may also run oinkmaster.pl -h for more usage information and options.
