SNORT no longer scanning Stopped 6/28/24 at 21 hour
-
First apologies if this is the wrong place to start.
open SNORT page, click on interfaces all looks good for a few seconds and then all the green icons change to empty rectangular boxes. No snort entries on GUI since 06/28/24. The last entries in the log - application scan said DNS from my wife's laptop to the DNS servers offered by my ISP.
No changes to SNORT or pfSense immediately preceding the stoppage. Last change in the previous 7 days was the update of patch manager.
Is there an update to SNORT which is not being offered to 24.03-RELEASE? The reason is it is SNORT is acting like it needs to be updated.
-
@The-Party-of-Hell-No what is “patch manager”?
You can reinstall the snort (any) package from system/packages.
-
@The-Party-of-Hell-No said in SNORT no longer scanning Stopped 6/28/24 at 21 hour:
then all the green icons change to empty rectangular boxes.
That sounds like a client side cache issue, icons not loaded. Try a different browser.
-
@stephenw10
Well I tried Edge - same thing few seconds of green check then a small blank rectangle
Also does not explain lack of alerts in the dashboard. I am making an assumption if the green check does not stay and no alerts - showing real time scans - then I assume Snort is not working. -
@SteveITS
Okay, okay not the patch manager - System - Patch which required an update.
So I have executed a reinstall of the package and nothing changed; should I get more aggressive and delete/remove SNORT and then install the package? -
Check the system logs after you try to start it.
-
@stephenw10
so I started an archived boot environment and had same problem.
Yes in the System Logs, General there are hundreds? of:
Invalid direct service AppId, 5340, for 0x8457b4c20 0x1b5a706b6e80
with many different digits not all the same.
and:
AppInfo: AppId 7338 is UNKNOWN
multiple with differing 4 digit numbers. -
Hmm, sounds like it's pulled in some invalid signatures. Or doesn't have pre-processors enabled for the signatures it has. And just did it again from the older BE.
Try disabling OpenAppID.
