Snort not starting one some or all interfaces.
-
Hi all,
I'm experiencing issues again with some devices running Snort. Other devices, running the same pfSense version, are starting Snort without any problems.
What logs do you need to help me identify the root cause and get Snort running on all pfSense instances? Chances are, the issue is the same across all pfSense instances where one or more Snort interfaces fail to start.
Cheers,
-
@Enso_ The snort log on Logs View tab would be the place to start. Anything useful here, or in the pfSense system log?
These are physical interfaces?
-
All running on virtual pfSense machines.
-
@Enso_ I wasn't clear, I meant VLANs. Snort/Suricata (basically) don't see VLAN tags so one only needs to run it on the parent.
Nothing in the logs then? It should log something if it doesn't start.
-
Snort will log a message to the pfSense system log as it starts. If it fails, generally the reason for the failure is also logged. The only exception to that is if a shared library is the wrong version or not present. That would only happen if you installed or updated some other package that shared a library with the Snort binary. That is very unlikely -- but not impossible.
The most common reason for Snort failing to start would be an error with a rule. It is not unheard of for the Snort VRT to release a rules update package with a syntax error in it. Snort will abort startup when it detects a syntax error. Rule syntax errors will be logged to the pfSense system log.
So, <TLDR;> check the pfSense system log immediately after trying to start Snort and see what is logged there. That will clue you in to the problem.
