• Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login
Netgate Discussion Forum
  • Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login

Snort inilization failure

Scheduled Pinned Locked Moved pfSense Packages
100 Posts 8 Posters 52.8k Views
Loading More Posts
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • Y
    yoda715
    last edited by Nov 3, 2006, 9:28 PM

    Grr. I just rebooted again, and it did not start up. I can't seem to find a pattern here.

    1 Reply Last reply Reply Quote 0
    • Y
      yoda715
      last edited by Nov 4, 2006, 9:32 PM

      ok. The problem still exists. I've rebooted 5 times. Inbetween each reboot, I waited 10 minutes. During the first 3 minutes on each reboot, Snort would start to initialize. 3-4 minutes after rebooting, snort will exit. Only way to get snort to start is to click 'save' under snort settings. After clicking 'save' and about 3 minutes later, snort completes initialization and I start to receive alerts.

      Here's the log of when it fails:

      Nov 4 16:18:18 snort[1003]: Snort exiting
      Nov 4 16:18:18 snort[1003]: Snort exiting
      Nov 4 16:18:18 kernel: sis0: promiscuous mode disabled
      Nov 4 16:18:18 snort[1003]: ===============================================================================
      Nov 4 16:18:18 snort[1003]: ===============================================================================
      Nov 4 16:18:18 snort[1003]: PASSED: 0
      Nov 4 16:18:18 snort[1003]: PASSED: 0
      Nov 4 16:18:18 snort[1003]: LOGGED: 0
      Nov 4 16:18:18 snort[1003]: LOGGED: 0
      Nov 4 16:18:18 snort[1003]: ALERTS: 0
      Nov 4 16:18:18 snort[1003]: ALERTS: 0
      Nov 4 16:18:18 snort[1003]: Action Stats:
      Nov 4 16:18:18 snort[1003]: Action Stats:
      Nov 4 16:18:18 snort[1003]: ===============================================================================
      Nov 4 16:18:18 snort[1003]: ===============================================================================
      Nov 4 16:18:18 snort[1003]: DISCARD: 0 (0.000%)
      Nov 4 16:18:18 snort[1003]: DISCARD: 0 (0.000%)
      Nov 4 16:18:18 snort[1003]: OTHER: 0 (0.000%)
      Nov 4 16:18:18 snort[1003]: OTHER: 0 (0.000%)
      Nov 4 16:18:18 snort[1003]: FRAG: 0 (0.000%)
      Nov 4 16:18:18 snort[1003]: FRAG: 0 (0.000%)
      Nov 4 16:18:18 snort[1003]: IPX: 0 (0.000%)
      Nov 4 16:18:18 snort[1003]: IPX: 0 (0.000%)
      Nov 4 16:18:18 snort[1003]: ETHLOOP: 0 (0.000%)
      Nov 4 16:18:18 snort[1003]: ETHLOOP: 0 (0.000%)
      Nov 4 16:18:18 snort[1003]: IPv6: 0 (0.000%)
      Nov 4 16:18:18 snort[1003]: IPv6: 0 (0.000%)
      Nov 4 16:18:18 snort[1003]: EAPOL: 0 (0.000%)
      Nov 4 16:18:18 snort[1003]: EAPOL: 0 (0.000%)
      Nov 4 16:18:18 snort[1003]: ARP: 0 (0.000%)
      Nov 4 16:18:18 snort[1003]: ARP: 0 (0.000%)
      Nov 4 16:18:18 snort[1003]: ICMP: 0 (0.000%)
      Nov 4 16:18:18 snort[1003]: ICMP: 0 (0.000%)
      Nov 4 16:18:18 snort[1003]: UDP: 0 (0.000%)
      Nov 4 16:18:18 snort[1003]: UDP: 0 (0.000%)
      Nov 4 16:18:18 snort[1003]: TCP: 0 (0.000%)
      Nov 4 16:18:18 snort[1003]: TCP: 0 (0.000%)
      Nov 4 16:18:18 snort[1003]: Breakdown by protocol:
      Nov 4 16:18:18 snort[1003]: Breakdown by protocol:
      Nov 4 16:18:18 snort[1003]: ===============================================================================
      Nov 4 16:18:18 snort[1003]: ===============================================================================
      Nov 4 16:18:18 snort[1003]: Outstanding: 709(66.887%)
      Nov 4 16:18:18 snort[1003]: Outstanding: 709(66.887%)
      Nov 4 16:18:18 snort[1003]: Dropped: 351(33.113%)
      Nov 4 16:18:18 snort[1003]: Dropped: 351(33.113%)
      Nov 4 16:18:18 snort[1003]: Analyzed: 0(0.000%)
      Nov 4 16:18:18 snort[1003]: Analyzed: 0(0.000%)
      Nov 4 16:18:18 snort[1003]: Snort received 1060 packets
      Nov 4 16:18:18 snort[1003]: Snort received 1060 packets
      Nov 4 16:18:18 snort[1003]: –----------------------------- Nov 4 16:18:18 snort[1003]: –-----------------------------
      Nov 4 16:18:18 snort[1003]: Recovered Nodes: 0
      Nov 4 16:18:18 snort[1003]: Recovered Nodes: 0
      Nov 4 16:18:18 snort[1003]: Nodes: 0
      Nov 4 16:18:18 snort[1003]: Nodes: 0
      Nov 4 16:18:18 snort[1003]: Finds: 0 (Sucessful: 0(%0.000000) Unsucessful: 0(%0.000000))
      Nov 4 16:18:18 snort[1003]: Finds: 0 (Sucessful: 0(%0.000000) Unsucessful: 0(%0.000000))
      Nov 4 16:18:18 snort[1003]: Memcap: 2097152 Overhead Bytes: 262152
      Nov 4 16:18:18 snort[1003]: Memcap: 2097152 Overhead Bytes: 262152
      Nov 4 16:18:18 snort[1003]: ,–---[SERVER STATS]–----------
      Nov 4 16:18:18 snort[1003]: ,–---[SERVER STATS]–----------
      Nov 4 16:18:18 snort[1003]: Recovered Nodes: 0
      Nov 4 16:18:18 snort[1003]: Recovered Nodes: 0
      Nov 4 16:18:18 snort[1003]: Nodes: 0
      Nov 4 16:18:18 snort[1003]: Nodes: 0
      Nov 4 16:18:18 snort[1003]: Finds: 0 (Sucessful: 0(%0.000000) Unsucessful: 0(%0.000000))
      Nov 4 16:18:18 snort[1003]: Finds: 0 (Sucessful: 0(%0.000000) Unsucessful: 0(%0.000000))
      Nov 4 16:18:18 snort[1003]: Memcap: 25165824 Overhead Bytes: 4000016
      Nov 4 16:18:18 snort[1003]: Memcap: 25165824 Overhead Bytes: 4000016
      Nov 4 16:18:18 snort[1003]: UNIQUE_TRACKER STATS
      Nov 4 16:18:18 snort[1003]: UNIQUE_TRACKER STATS
      Nov 4 16:18:18 snort[1003]: Score Entry Size:: 112
      Nov 4 16:18:18 snort[1003]: Score Entry Size:: 112
      Nov 4 16:18:18 snort[1003]: Recovered Nodes: 0
      Nov 4 16:18:18 snort[1003]: Recovered Nodes: 0
      Nov 4 16:18:18 snort[1003]: Nodes: 0
      Nov 4 16:18:18 snort[1003]: Nodes: 0
      Nov 4 16:18:18 snort[1003]: Finds: 0 (Sucessful: 0(%0.000000) Unsucessful: 0(%0.000000))
      Nov 4 16:18:18 snort[1003]: Finds: 0 (Sucessful: 0(%0.000000) Unsucessful: 0(%0.000000))
      Nov 4 16:18:18 snort[1003]: Memcap: 6291456 Overhead Bytes: 1000032
      Nov 4 16:18:18 snort[1003]: Memcap: 6291456 Overhead Bytes: 1000032
      Nov 4 16:18:18 snort[1003]: SCOREBOARD_STATS: Portscanners
      Nov 4 16:18:18 snort[1003]: SCOREBOARD_STATS: Portscanners
      Nov 4 16:18:18 snort[1003]: Score Entry Size:: 112
      Nov 4 16:18:18 snort[1003]: Score Entry Size:: 112
      Nov 4 16:18:18 snort[1003]: Recovered Nodes: 0
      Nov 4 16:18:18 snort[1003]: Recovered Nodes: 0
      Nov 4 16:18:18 snort[1003]: Nodes: 0
      Nov 4 16:18:18 snort[1003]: Nodes: 0
      Nov 4 16:18:18 snort[1003]: Finds: 0 (Sucessful: 0(%0.000000) Unsucessful: 0(%0.000000))
      Nov 4 16:18:18 snort[1003]: Finds: 0 (Sucessful: 0(%0.000000) Unsucessful: 0(%0.000000))
      Nov 4 16:18:18 snort[1003]: Memcap: 25165824 Overhead Bytes: 120048
      Nov 4 16:18:18 snort[1003]: Memcap: 25165824 Overhead Bytes: 120048
      Nov 4 16:18:18 snort[1003]: SCOREBOARD_STATS: Active Talkers
      Nov 4 16:18:18 snort[1003]: SCOREBOARD_STATS: Active Talkers
      Nov 4 16:18:18 snort[1003]: +–-[ Flow-portscan Stats ]–--------------+
      Nov 4 16:18:18 snort[1003]: +–-[ Flow-portscan Stats ]–--------------+
      Nov 4 16:18:18 snort[1003]: finds: 0 reversed: 0(%0.000000) find_success: 0 find_fail: 0 percent_success: (%0.000000) new_flows: 0
      Nov 4 16:18:18 snort[1003]: finds: 0 reversed: 0(%0.000000) find_success: 0 find_fail: 0 percent_success: (%0.000000) new_flows: 0
      Nov 4 16:18:18 snort[1003]: IPV4 count: 0 frees: 0 low_time: 0, high_time: 0, diff: 0h:00:00s
      Nov 4 16:18:18 snort[1003]: IPV4 count: 0 frees: 0 low_time: 0, high_time: 0, diff: 0h:00:00s
      Nov 4 16:18:18 snort[1003]: Memcap: 10485760 Overhead Bytes 16400 used(%0.156403)/blocks (16400/1) Overhead blocks: 1 Could Hold: (0)
      Nov 4 16:18:18 snort[1003]: Memcap: 10485760 Overhead Bytes 16400 used(%0.156403)/blocks (16400/1) Overhead blocks: 1 Could Hold: (0)
      Nov 4 16:18:18 snort[1003]: ,–--[ FLOWCACHE STATS ]–--------
      Nov 4 16:18:18 snort[1003]: ,–--[ FLOWCACHE STATS ]–--------
      Nov 4 16:18:18 snort[1003]: Final Flow Statistics
      Nov 4 16:18:18 snort[1003]: Final Flow Statistics
      Nov 4 16:18:18 snort[1003]: *** Caught Term-Signal
      Nov 4 16:18:18 snort[1003]: *** Caught Term-Signal
      Nov 4 16:18:18 snort[1003]: Not Using PCAP_FRAMES
      Nov 4 16:18:18 snort[1003]: Not Using PCAP_FRAMES
      Nov 4 16:18:18 snort[1003]: Snort initialization completed successfully (pid=1003)
      Nov 4 16:18:18 snort[1003]: Snort initialization completed successfully (pid=1003)
      Nov 4 16:18:11 check_reload_status: updating dyndns
      Nov 4 16:18:11 php: : [SNORT] Snort_dynamic_ip_reload.php is starting.
      Nov 4 16:17:11 SnortStartup[1292]: Ram free BEFORE starting Snort: 18M – Ram free AFTER starting Snort: 702M -- Mode ac-sparsebands -- Snort memory usage:
      Nov 4 16:16:54 snort2c[1253]: snort2c running in daemon mode pid: 1253
      Nov 4 16:16:54 snort2c[1253]: snort2c running in daemon mode pid: 1253
      Nov 4 16:16:54 snort[1092]: Daemon parent exiting
      Nov 4 16:16:54 snort[1092]: Daemon parent exiting
      Nov 4 16:16:52 snort[1092]: Child exited unexpectedly
      Nov 4 16:16:52 snort[1092]: Child exited unexpectedly
      Nov 4 16:16:51 snort[1242]: FATAL ERROR: Failed to Lock PID File "/var/run//snort_sis0.pid" for PID "1242"
      Nov 4 16:16:51 snort[1242]: FATAL ERROR: Failed to Lock PID File "/var/run//snort_sis0.pid" for PID "1242"
      Nov 4 16:16:51 snort[1242]: PID path stat checked out ok, PID path set to /var/run/
      Nov 4 16:16:51 snort[1242]: PID path stat checked out ok, PID path set to /var/run/
      Nov 4 16:16:51 snort[1242]: Var 'sis0_ADDRESS' redefined
      Nov 4 16:16:51 snort[1242]: Var 'sis0_ADDRESS' redefined

      1 Reply Last reply Reply Quote 0
      • B
        billm
        last edited by Nov 5, 2006, 3:07 PM

        No wisdom to add here, but wtf?!?!?!?

        Nov 4 16:17:11    SnortStartup[1292]: Ram free BEFORE starting Snort: 18M – Ram free AFTER starting Snort: 702M -- Mode ac-sparsebands -- Snort memory usage:

        --Bill

        pfSense core developer
        blog - http://www.ucsecurity.com/
        twitter - billmarquette

        1 Reply Last reply Reply Quote 0
        • Y
          yoda715
          last edited by Nov 5, 2006, 8:31 PM

          I see the same problem.

          1 Reply Last reply Reply Quote 0
          • Y
            yoda715
            last edited by Nov 7, 2006, 7:22 AM

            I am also seeing snort randomly restart itself. It seems to happen in the middle of the night. Anyone seeing this in their logs?

            1 Reply Last reply Reply Quote 0
            • S
              sullrich
              last edited by Nov 7, 2006, 8:24 PM

              DHCP?  It restarts after renewing the lease.  Normal.

              1 Reply Last reply Reply Quote 0
              • Y
                yoda715
                last edited by Nov 8, 2006, 5:16 AM

                Ok. That would explain random restarts. However, sometimes when it restarts at night it does not fully initialize and will terminate. I have to click save to start it up again.

                1 Reply Last reply Reply Quote 0
                • P
                  PC_Arcade
                  last edited by Nov 8, 2006, 11:26 AM

                  @yoda715:

                  Ok. That would explain random restarts. However, sometimes when it restarts at night it does not fully initialize and will terminate. I have to click save to start it up again.

                  I'm getting this as well :

                  Nov 8 11:27:52 	kernel: fxp2: promiscuous mode disabled
                  Nov 8 11:27:52 	kernel: pid 83265 (snort), uid 0: exited on signal 11 (core dumped)
                  Nov 8 11:26:06 	snort[83265]: Not Using PCAP_FRAMES
                  Nov 8 11:26:06 	snort[83265]: Not Using PCAP_FRAMES
                  Nov 8 11:26:06 	snort[83265]: Snort initialization completed successfully (pid=83265)
                  Nov 8 11:26:06 	snort[83265]: Snort initialization completed successfully (pid=83265)
                  

                  and again after pressing save :

                  Nov 8 11:34:55 	kernel: fxp2: promiscuous mode disabled
                  Nov 8 11:34:55 	kernel: pid 84220 (snort), uid 0: exited on signal 11 (core dumped)
                  Nov 8 11:33:25 	snort[84220]: Not Using PCAP_FRAMES
                  Nov 8 11:33:25 	snort[84220]: Not Using PCAP_FRAMES
                  Nov 8 11:33:25 	snort[84220]: Snort initialization completed successfully (pid=84220)
                  Nov 8 11:33:25 	snort[84220]: Snort initialization completed successfully (pid=84220)
                  Nov 8 11:33:02 	SnortStartup[84242]: Ram free BEFORE starting Snort: 110M -- Ram free AFTER starting Snort: 110M -- Mode ac-sparsebands -- Snort memory usage:
                  

                  The problem is that it doesn't restart, I'm also not sure why it exited in the first place, it's not due to an IP change and 1Gb of ram should be enough

                  Specs = P4 2.4
                  1gb ram
                  3xIntel Pro 100 nics

                  1 Reply Last reply Reply Quote 0
                  • Y
                    yoda715
                    last edited by Nov 8, 2006, 5:58 PM

                    @PC_Arcade:

                    @yoda715:

                    Ok. That would explain random restarts. However, sometimes when it restarts at night it does not fully initialize and will terminate. I have to click save to start it up again.

                    I'm getting this as well :

                    Nov 8 11:27:52 	kernel: fxp2: promiscuous mode disabled
                    Nov 8 11:27:52 	kernel: pid 83265 (snort), uid 0: exited on signal 11 (core dumped)
                    Nov 8 11:26:06 	snort[83265]: Not Using PCAP_FRAMES
                    Nov 8 11:26:06 	snort[83265]: Not Using PCAP_FRAMES
                    Nov 8 11:26:06 	snort[83265]: Snort initialization completed successfully (pid=83265)
                    Nov 8 11:26:06 	snort[83265]: Snort initialization completed successfully (pid=83265)
                    

                    and again after pressing save :

                    Nov 8 11:34:55 	kernel: fxp2: promiscuous mode disabled
                    Nov 8 11:34:55 	kernel: pid 84220 (snort), uid 0: exited on signal 11 (core dumped)
                    Nov 8 11:33:25 	snort[84220]: Not Using PCAP_FRAMES
                    Nov 8 11:33:25 	snort[84220]: Not Using PCAP_FRAMES
                    Nov 8 11:33:25 	snort[84220]: Snort initialization completed successfully (pid=84220)
                    Nov 8 11:33:25 	snort[84220]: Snort initialization completed successfully (pid=84220)
                    Nov 8 11:33:02 	SnortStartup[84242]: Ram free BEFORE starting Snort: 110M -- Ram free AFTER starting Snort: 110M -- Mode ac-sparsebands -- Snort memory usage:
                    

                    The problem is that it doesn't restart, I'm also not sure why it exited in the first place, it's not due to an IP change and 1Gb of ram should be enough

                    Specs = P4 2.4
                    1gb ram
                    3xIntel Pro 100 nics

                    I have the same specs on my machine, however when I click save snort does successfully boot back up. If you are not running in ac-sparsebands mode, try running in that mode and see if it works for you.

                    At any rate at least I know I am not the only one with this problem.

                    1 Reply Last reply Reply Quote 0
                    • P
                      PC_Arcade
                      last edited by Nov 8, 2006, 7:06 PM

                      It does load back up after I press save, but only for a minute or 2 then it bombs out again

                      1 Reply Last reply Reply Quote 0
                      • S
                        sullrich
                        last edited by Nov 8, 2006, 9:10 PM

                        Nov 8 11:27:52 kernel: pid 83265 (snort), uid 0: exited on signal 11 (core dumped) …. Sounds like its running out of RAM.

                        1 Reply Last reply Reply Quote 0
                        • P
                          PC_Arcade
                          last edited by Nov 8, 2006, 10:06 PM

                          On 1GB of ram?

                          Blimey!

                          Time to drop snort then :LOL:

                          The irony here is that it would run for ages on a machine with only 256mb of ram, so I upgraded to 1GB and it won't work for more than a minute or 2.

                          That's very odd behaviour.

                          1 Reply Last reply Reply Quote 0
                          • S
                            sullrich
                            last edited by Nov 8, 2006, 10:20 PM

                            1 gig should be plenty.  Not sure why its core dumping then..  Shrugs.

                            1 Reply Last reply Reply Quote 0
                            • Y
                              yoda715
                              last edited by Nov 9, 2006, 7:43 AM Nov 9, 2006, 3:06 AM

                              I am running 1 gig as well. I know its not shutting down due to low ram. When snort is running my memory usage stays around 55-60%. At no point do I see my memory reach 80, 90, or 100%. I have swap enabled and it's always at 0%. When snort is not running my mem usage is 5-6%.

                              I am not trying to insult you Scott nor do I doubt your intelligence on this issue, but I can say this with 99% certainty: The issue is something other than running out of ram. :)

                              So basically Snort is not starting up on reboots, and on dhcp renewal.

                              Do you want me to send you a copy of my config Scott, to see if you can get this to duplicate?

                              1 Reply Last reply Reply Quote 0
                              • P
                                PC_Arcade
                                last edited by Nov 9, 2006, 11:00 AM

                                @yoda715:

                                I am running 1 gig as well. I know its not shutting down due to low ram. When snort is running my memory usage stays around 55-60%. At no point do I see my memory reach 80, 90, or 100%. I have swap enabled and it's always at 0%. When snort is not running my mem usage is 5-6%.

                                I am not trying to insult you Scott nor do I doubt your intelligence on this issue, but I can say this with 99% certainty: The issue is something other than running out of ram. :)

                                So basically Snort is not starting up on reboots, and on dhcp renewal.

                                Do you want me to send you a copy of my config Scott, to see if you can get this to duplicate?

                                All the above applies to me too, as does the offer of configs and any other help I can give :)

                                1 Reply Last reply Reply Quote 0
                                • Y
                                  yoda715
                                  last edited by Nov 11, 2006, 9:34 AM

                                  I've noticed something in my testing. It seems that whatever is causing snort to fail on bootup the first time, it's towards the end of the bootup process.

                                  1 Reply Last reply Reply Quote 0
                                  • P
                                    PC_Arcade
                                    last edited by Nov 19, 2006, 9:40 PM

                                    I take it the offer of configs and logs is not wanted?

                                    Would a donation help to get this looked at?

                                    1 Reply Last reply Reply Quote 0
                                    • S
                                      sullrich
                                      last edited by Nov 19, 2006, 10:15 PM

                                      Try uninstalling and reinstalling the package.  I just uploaded a re compiled version.

                                      1 Reply Last reply Reply Quote 0
                                      • Y
                                        yoda715
                                        last edited by Nov 20, 2006, 1:01 AM

                                        Still experiencing the same issue. Had to click save after reinstall and reboot to get Snort to startup. Any luck PC_Arcade?

                                        1 Reply Last reply Reply Quote 0
                                        • S
                                          sullrich
                                          last edited by Nov 20, 2006, 1:41 AM

                                          You may also want to upgrade to http://www.pfsense.com/~sullrich/1.0.1-SNAPSHOT-11-19-2006/

                                          6.2-RC1

                                          1 Reply Last reply Reply Quote 0
                                          • First post
                                            Last post
                                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.
                                            This community forum collects and processes your personal information.
                                            consent.not_received