New Inspector not recognized by snort3

[Jaegersan]

Hi,
I created a new Inspector by copying most of the dpx inspector file.
I updated the sub-directory in ./inspectors and I am able to build/make/make install the project.
I can also see my custom inspector in the build tree. The "custom_plugin.so" file is also placed in the right location.

Now when I try to execute snort3 with a local pcap file:
sudo /usr/local/bin/snort -c /usr/local/etc/snort/snort.lua -r ~/pcap_dir/test.pcap -l /var/log/snort --plugin-path /usr/local/etc/so_rules/ --script-path ~/snort3_extra
It is running without any errors and snort3 is doing what it should do except that my custom inspector was not loaded and did nothing...
I added some print message to check if the methods of my inspector are called.

Btw. I also added the custom inspector to snort.lua:
custom_plugin = { }

I don't know if this information is important but PKG_CONFIG_PATH is pointing to /usr/local/lib/pkgconfig. (It also contains a snort.pc inside)

Would be nice if someone knows what I am missing :/

[snortadmin]

It looks like your --plugin-path arg is not including the install directory for your plugin. You can specify a colon separated list with that arg and include the install path of your plugin.

You can check that the plugin is loaded like this:

$ snort --warn-all --plugin-path <so_path>:<cusotm_path> --list-plugins

Be sure to put --list-plugins last as shown. The warnings will reveal any plugin that fails to load due to missing symbols.

[Jaegersan]

Hi,
I received these two warnings:

WARNING: /home/jaeger/snort3_extra/build/src/daqs/daq_socket/daq_socket.so: undefined symbol: snort_plugins (/home/jaeger/snort3_extra/build/src/daqs/daq_socket/daq_socket.so)
WARNING: /home/jaeger/snort3_extra/build/src/tp_appid/tp_appid_example.so: undefined symbol: snort_plugins (/home/jaeger/snort3_extra/build/src/tp_appid/tp_appid_example.so)

After that a bunch of modules/files were listed. Even my custom inspector was there.
inspector::custom_plugin v0 /home/jaeger/snort3_extra/build/src/inspectors/custom_plugin/custom_plugin.so

I updated my command to see if I receive any warning in the actual run.
sudo /usr/local/bin/snort --warn-all -c /usr/local/etc/snort/snort.lua -r ~/pcap_dir/test.pcap -l /var/log/snort --plugin-path /usr/local/etc/so_rules/:/home/jaeger/snort3_extra

And right at the beginning when all the inspectors were loaded I got this warning:
"WARNING: /usr/local/etc/snort/snort.lua: unknown table custom_plugin"

In snort.lua I just added this to the inspector section: custom_plugin = { }.
Is this not the right way to do this?

[Jaegersan]

Update:
When I change the order from
--plugin-path /usr/local/etc/so_rules/:/home/jaeger/snort3_extra
to
--plugin-path /home/jaeger/snort3_extra:/usr/local/etc/so_rules/ it actually works.