# $Id: INSTALL,v 1.13 2002/05/03 12:31:33 andreaso Exp $ #

Installation instructions for Oinkmaster v0.5
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

o Put oinkmaster.pl and oinkmaster.conf in some suitable directory/directories.
  It doesn't really matter where.

o Edit the file oinkmaster.conf. There are some options you may want to
  change before even starting. Here you will then also tell Oinkmaster which
  SIDs or files you want to disable or ignore. As you will see, a few things
  are disabled/ignored by default.

  If you already have several rules commented out (or removed) in your current
  rules, you need to add those SIDs to oinkmaster.conf manually, or they  
  will be re-enabled after each update. Note that Oinkmaster will enable 
  all rules by default. Even those that are commented out by default in 
  the rules archive will be enabled, unless -p is specified. Note that
  those rules are commented out for a reason (they may not even work!),
  thus using -p is usually recommended.
  Also note that possible local modifications you've done inside the official
  Snort rules files will be lost since the files will be overwritten by the
  new versions from the downloaded rules archive after each update.

o Decide in which directory you want to put the new rules. Since you probably
  already have Snort up and running, you should use your existing rules
  directory. If you for example have the official Snort rules stored in
  /snort/snort.org-rules/ you can now update those by running:

  ./oinkmaster.pl -o /snort/snort.org-rules/

  You REALLY should check out the entire README before doing anything though.
  You may also run oinkmaster.pl -h for more usage information and options.
