Hi, I'm testing snort wokrin as a daemon, I checked a simple rule with ICMP and it puts it to the logs.

I tried sth more complicated, a rule logging DNS requests
"alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:....etc"

in snort.conf file there are:
ipvar HOME_NET any
ipvar DNS_SERVERS $HOME_NET
ipvar SMTP_SERVERS $HOME_NET

when launching snort with -T parameter to check the rules it says:
"ERROR /etc/snort/rules/file.rules(5) !any is not allowed: ![$SMTP_SERVERS,$DNS_SERVERS].
Fatal error quitting"

what could be the problem ? what to check first
please help
{"cc_re__cc_re__cc_by_sa_4_0": ["sing div for body_wrapper -->\r\n\r\n<div class=\"below_body\">\r\n<div id=\"footer_time\" class=\"shade footer_time\">All times are GMT +1. The time now is <span class=\"time\">08:08 AM</span>.</div>\r\n\r\n<div id=\"footer_copyright\" class=\"shade footer_copyright\">\r\n\t<!-- Do not remove this copyright notice -->\r\n\tvBulletin  2000 - 2018, Jelsoft Enterprises Ltd. Ubuntu Logo, Ubuntu and Canonical  Canonical Ltd. Tango Icons  Tango Desktop Project. \r\n<br>\r\nUser contributions on this site are licensed under the  <a href=\"https://creativecommons.org/licenses/by-sa/4.0/\">Creative Commons Attribution Share Alike 4.0 International License</a>. For details and our forum data attribution, retention and privacy policy, see <a href=\"http://ubuntuforums.org/showthread.php?t=2231107\">here</a> \r\n\r\n\t<!-- Do not remove this copyright notice -->\t\r\n</div>\r\n<div id=\"footer_morecopyright\" class=\"shade footer_morecopyright\">\r\n\t<!-- Do not remove cronimage or your scheduled tasks will cease to function -->\r\n\t\r\n\t<!-- Do not remove cronimage or your scheduled tasks will cease to f"], "copyright__copyright__copyright": ["it to the logs.\n\nI tried sth more complicated, a rule logging DNS requests\n\"alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:....etc\"\n\nin snort.conf file there are:\nipvar HOME_NET any\nipvar DNS_SERVERS $HOME_NET\nipvar SMTP_SERVERS $HOME_NET\n\nwhen launching snort with -T parameter to check the rules it says:\n\"ERROR /etc/snort/rules/file.rules(5) !any is not allowed: ![$SMTP_SERVERS,$DNS_SERVERS].\nFatal error quitting\"\n\nwhat could be the problem ? what to check first\nplease help", "it to the logs.\n\nI tried sth more complicated, a rule logging DNS requests\n\"alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:....etc\"\n\nin snort.conf file there are:\nipvar HOME_NET any\nipvar DNS_SERVERS $HOME_NET\nipvar SMTP_SERVERS $HOME_NET\n\nwhen launching snort with -T parameter to check the rules it says:\n\"ERROR /etc/snort/rules/file.rules(5) !any is not allowed: ![$SMTP_SERVERS,$DNS_SERVERS].\nFatal error quitting\"\n\nwhat could be the problem ? what to check first\nplease help", "it to the logs.\n\nI tried sth more complicated, a rule logging DNS requests\n\"alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:....etc\"\n\nin snort.conf file there are:\nipvar HOME_NET any\nipvar DNS_SERVERS $HOME_NET\nipvar SMTP_SERVERS $HOME_NET\n\nwhen launching snort with -T parameter to check the rules it says:\n\"ERROR /etc/snort/rules/file.rules(5) !any is not allowed: ![$SMTP_SERVERS,$DNS_SERVERS].\nFatal error quitting\"\n\nwhat could be the problem ? what to check first\nplease help", "it to the logs.\n\nI tried sth more complicated, a rule logging DNS requests\n\"alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:....etc\"\n\nin snort.conf file there are:\nipvar HOME_NET any\nipvar DNS_SERVERS $HOME_NET\nipvar SMTP_SERVERS $HOME_NET\n\nwhen launching snort with -T parameter to check the rules it says:\n\"ERROR /etc/snort/rules/file.rules(5) !any is not allowed: ![$SMTP_SERVERS,$DNS_SERVERS].\nFatal error quitting\"\n\nwhat could be the problem ? what to check first\nplease help", "it to the logs.\n\nI tried sth more complicated, a rule logging DNS requests\n\"alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:....etc\"\n\nin snort.conf file there are:\nipvar HOME_NET any\nipvar DNS_SERVERS $HOME_NET\nipvar SMTP_SERVERS $HOME_NET\n\nwhen launching snort with -T parameter to check the rules it says:\n\"ERROR /etc/snort/rules/file.rules(5) !any is not allowed: ![$SMTP_SERVERS,$DNS_SERVERS].\nFatal error quitting\"\n\nwhat could be the problem ? what to check first\nplease help", "it to the logs.\n\nI tried sth more complicated, a rule logging DNS requests\n\"alert udp ![$SMTP_SERVERS,$DNS_SERVERS] any -> $DNS_SERVERS 53 (msg:....etc\"\n\nin snort.conf file there are:\nipvar HOME_NET any\nipvar DNS_SERVERS $HOME_NET\nipvar SMTP_SERVERS $HOME_NET\n\nwhen launching snort with -T parameter to check the rules it says:\n\"ERROR /etc/snort/rules/file.rules(5) !any is not allowed: ![$SMTP_SERVERS,$DNS_SERVERS].\nFatal error quitting\"\n\nwhat could be the problem ? what to check first\nplease help"]}