Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Snort inilization failure

    Scheduled Pinned Locked Moved pfSense Packages
    100 Posts 8 Posters 56.2k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • Y Offline
      yoda715
      last edited by

      I see the same problem.

      1 Reply Last reply Reply Quote 0
      • Y Offline
        yoda715
        last edited by

        I am also seeing snort randomly restart itself. It seems to happen in the middle of the night. Anyone seeing this in their logs?

        1 Reply Last reply Reply Quote 0
        • S Offline
          sullrich
          last edited by

          DHCP?  It restarts after renewing the lease.  Normal.

          1 Reply Last reply Reply Quote 0
          • Y Offline
            yoda715
            last edited by

            Ok. That would explain random restarts. However, sometimes when it restarts at night it does not fully initialize and will terminate. I have to click save to start it up again.

            1 Reply Last reply Reply Quote 0
            • P Offline
              PC_Arcade
              last edited by

              @yoda715:

              Ok. That would explain random restarts. However, sometimes when it restarts at night it does not fully initialize and will terminate. I have to click save to start it up again.

              I'm getting this as well :

              Nov 8 11:27:52 	kernel: fxp2: promiscuous mode disabled
Nov 8 11:27:52 	kernel: pid 83265 (snort), uid 0: exited on signal 11 (core dumped)
Nov 8 11:26:06 	snort[83265]: Not Using PCAP_FRAMES
Nov 8 11:26:06 	snort[83265]: Not Using PCAP_FRAMES
Nov 8 11:26:06 	snort[83265]: Snort initialization completed successfully (pid=83265)
Nov 8 11:26:06 	snort[83265]: Snort initialization completed successfully (pid=83265)

              and again after pressing save :

              Nov 8 11:34:55 	kernel: fxp2: promiscuous mode disabled
Nov 8 11:34:55 	kernel: pid 84220 (snort), uid 0: exited on signal 11 (core dumped)
Nov 8 11:33:25 	snort[84220]: Not Using PCAP_FRAMES
Nov 8 11:33:25 	snort[84220]: Not Using PCAP_FRAMES
Nov 8 11:33:25 	snort[84220]: Snort initialization completed successfully (pid=84220)
Nov 8 11:33:25 	snort[84220]: Snort initialization completed successfully (pid=84220)
Nov 8 11:33:02 	SnortStartup[84242]: Ram free BEFORE starting Snort: 110M -- Ram free AFTER starting Snort: 110M -- Mode ac-sparsebands -- Snort memory usage:

              The problem is that it doesn't restart, I'm also not sure why it exited in the first place, it's not due to an IP change and 1Gb of ram should be enough

              Specs = P4 2.4
              1gb ram
              3xIntel Pro 100 nics

              1 Reply Last reply Reply Quote 0
              • Y Offline
                yoda715
                last edited by

                @PC_Arcade:

                @yoda715:

                Ok. That would explain random restarts. However, sometimes when it restarts at night it does not fully initialize and will terminate. I have to click save to start it up again.

                I'm getting this as well :

                Nov 8 11:27:52 	kernel: fxp2: promiscuous mode disabled
Nov 8 11:27:52 	kernel: pid 83265 (snort), uid 0: exited on signal 11 (core dumped)
Nov 8 11:26:06 	snort[83265]: Not Using PCAP_FRAMES
Nov 8 11:26:06 	snort[83265]: Not Using PCAP_FRAMES
Nov 8 11:26:06 	snort[83265]: Snort initialization completed successfully (pid=83265)
Nov 8 11:26:06 	snort[83265]: Snort initialization completed successfully (pid=83265)

                and again after pressing save :

                Nov 8 11:34:55 	kernel: fxp2: promiscuous mode disabled
Nov 8 11:34:55 	kernel: pid 84220 (snort), uid 0: exited on signal 11 (core dumped)
Nov 8 11:33:25 	snort[84220]: Not Using PCAP_FRAMES
Nov 8 11:33:25 	snort[84220]: Not Using PCAP_FRAMES
Nov 8 11:33:25 	snort[84220]: Snort initialization completed successfully (pid=84220)
Nov 8 11:33:25 	snort[84220]: Snort initialization completed successfully (pid=84220)
Nov 8 11:33:02 	SnortStartup[84242]: Ram free BEFORE starting Snort: 110M -- Ram free AFTER starting Snort: 110M -- Mode ac-sparsebands -- Snort memory usage:

                The problem is that it doesn't restart, I'm also not sure why it exited in the first place, it's not due to an IP change and 1Gb of ram should be enough

                Specs = P4 2.4
                1gb ram
                3xIntel Pro 100 nics

                I have the same specs on my machine, however when I click save snort does successfully boot back up. If you are not running in ac-sparsebands mode, try running in that mode and see if it works for you.

                At any rate at least I know I am not the only one with this problem.

                1 Reply Last reply Reply Quote 0
                • P Offline
                  PC_Arcade
                  last edited by

                  It does load back up after I press save, but only for a minute or 2 then it bombs out again

                  1 Reply Last reply Reply Quote 0
                  • S Offline
                    sullrich
                    last edited by

                    Nov 8 11:27:52 kernel: pid 83265 (snort), uid 0: exited on signal 11 (core dumped) …. Sounds like its running out of RAM.

                    1 Reply Last reply Reply Quote 0
                    • P Offline
                      PC_Arcade
                      last edited by

                      On 1GB of ram?

                      Blimey!

                      Time to drop snort then :LOL:

                      The irony here is that it would run for ages on a machine with only 256mb of ram, so I upgraded to 1GB and it won't work for more than a minute or 2.

                      That's very odd behaviour.

                      1 Reply Last reply Reply Quote 0
                      • S Offline
                        sullrich
                        last edited by

                        1 gig should be plenty.  Not sure why its core dumping then..  Shrugs.

                        1 Reply Last reply Reply Quote 0
                        • Y Offline
                          yoda715
                          last edited by

                          I am running 1 gig as well. I know its not shutting down due to low ram. When snort is running my memory usage stays around 55-60%. At no point do I see my memory reach 80, 90, or 100%. I have swap enabled and it's always at 0%. When snort is not running my mem usage is 5-6%.

                          I am not trying to insult you Scott nor do I doubt your intelligence on this issue, but I can say this with 99% certainty: The issue is something other than running out of ram. :)

                          So basically Snort is not starting up on reboots, and on dhcp renewal.

                          Do you want me to send you a copy of my config Scott, to see if you can get this to duplicate?

                          1 Reply Last reply Reply Quote 0
                          • P Offline
                            PC_Arcade
                            last edited by

                            @yoda715:

                            I am running 1 gig as well. I know its not shutting down due to low ram. When snort is running my memory usage stays around 55-60%. At no point do I see my memory reach 80, 90, or 100%. I have swap enabled and it's always at 0%. When snort is not running my mem usage is 5-6%.

                            I am not trying to insult you Scott nor do I doubt your intelligence on this issue, but I can say this with 99% certainty: The issue is something other than running out of ram. :)

                            So basically Snort is not starting up on reboots, and on dhcp renewal.

                            Do you want me to send you a copy of my config Scott, to see if you can get this to duplicate?

                            All the above applies to me too, as does the offer of configs and any other help I can give :)

                            1 Reply Last reply Reply Quote 0
                            • Y Offline
                              yoda715
                              last edited by

                              I've noticed something in my testing. It seems that whatever is causing snort to fail on bootup the first time, it's towards the end of the bootup process.

                              1 Reply Last reply Reply Quote 0
                              • P Offline
                                PC_Arcade
                                last edited by

                                I take it the offer of configs and logs is not wanted?

                                Would a donation help to get this looked at?

                                1 Reply Last reply Reply Quote 0
                                • S Offline
                                  sullrich
                                  last edited by

                                  Try uninstalling and reinstalling the package.  I just uploaded a re compiled version.

                                  1 Reply Last reply Reply Quote 0
                                  • Y Offline
                                    yoda715
                                    last edited by

                                    Still experiencing the same issue. Had to click save after reinstall and reboot to get Snort to startup. Any luck PC_Arcade?

                                    1 Reply Last reply Reply Quote 0
                                    • S Offline
                                      sullrich
                                      last edited by

                                      You may also want to upgrade to http://www.pfsense.com/~sullrich/1.0.1-SNAPSHOT-11-19-2006/

                                      6.2-RC1

                                      1 Reply Last reply Reply Quote 0
                                      • J Offline
                                        Justinw
                                        last edited by

                                        I have tested the snort package under 1.01 about a week ago and it ran fine for me, although I only ran it for about a couple of days.  Not to throw out the obvious here, but if pc_arcade had it running under 256 but not under a gig, it sounds like there is a good possibility that there is possibly some bad ram in the mix. I'd run a checkmem on it and see what happens.

                                        1 Reply Last reply Reply Quote 0
                                        • Y Offline
                                          yoda715
                                          last edited by

                                          @sullrich:

                                          You may also want to upgrade to http://www.pfsense.com/~sullrich/1.0.1-SNAPSHOT-11-19-2006/

                                          6.2-RC1

                                          Will do. Does that need to be a fresh install or will an upgrade be ok?

                                          1 Reply Last reply Reply Quote 0
                                          • Y Offline
                                            yoda715
                                            last edited by

                                            @Justinw:

                                            I have tested the snort package under 1.01 about a week ago and it ran fine for me, although I only ran it for about a couple of days.  Not to throw out the obvious here, but if pc_arcade had it running under 256 but not under a gig, it sounds like there is a good possibility that there is possibly some bad ram in the mix. I'd run a checkmem on it and see what happens.

                                            Doubt it. If it was a bad batch of Memory it wouldn't run at all.

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.