Snort inilization failure
-
You may also want to upgrade to http://www.pfsense.com/~sullrich/1.0.1-SNAPSHOT-11-19-2006/
6.2-RC1
Will do. Does that need to be a fresh install or will an upgrade be ok?
-
I have tested the snort package under 1.01 about a week ago and it ran fine for me, although I only ran it for about a couple of days. Not to throw out the obvious here, but if pc_arcade had it running under 256 but not under a gig, it sounds like there is a good possibility that there is possibly some bad ram in the mix. I'd run a checkmem on it and see what happens.
Doubt it. If it was a bad batch of Memory it wouldn't run at all.
-
-
No go. Snort initialization is stuck in an infinite loop. It will initialize, reach about 90% bootup complete, terminate, and start over. I'm counting five times so far that it has started to initialize, failed, restarted initialization, and it keeps failing over and over.
-
Clicking Save in snort settings stopped the loop and successfully booted Snort.
-
Hi, Just 'd like to ask what's the status here with the issue ?
my pfsense is 1.0.1
Last time it was with 1.0-RC3 when snort caused network problem
and it was quite a headache to try to find out what's wrong till
we have to take off snort all together.I assume then 6.2 RC1 ( Scott's earlier link ) + snort works alright ?
I have more than 1 G ram for pfsense.
Cheers,
-
Snort works. Its just the initialization process I am experiencing issues with. I don't believe everyone is experiencing it. Once snort initializes successfully it works great. You can run a port scan on your firewall and you will see it in the logs.
-
Snort works. Its just the initialization process I am experiencing issues with. I don't believe everyone is experiencing it. Once snort initializes successfully it works great. You can run a port scan on your firewall and you will see it in the logs.
aah Ok, thanks yoda715
gl for that
-
Still experiencing the same issue. Had to click save after reinstall and reboot to get Snort to startup. Any luck PC_Arcade?
Same behaviour with just the package update, I'll try the pfsense update later and report back
-
I didn't see any different behavior until I updated to the latest snapshot. Then snort would get stuck in an infinite initialization loop.
-
I'm loathe to install the newer build, because it looks like all it is doing is forcing a restart of snort and that will, as you point out, cause an infinite loop as there is a problem with the initialisation which causes it to bomb out.
-
I didn't see any different behavior until I updated to the latest snapshot. Then snort would get stuck in an infinite initialization loop.
Thats funny. I haven't changed anything… All that the new image contains is FreeBSD 6.2.
-
I can confirm that under the new version, the results are exactly the same.
After a while snort exits with a core dump (it doesn't reload)
-
I can still provide a configuration file to help out, if you wish .
-
I had the same problem for awhile….snort always ending in a core dump. (I have 1 gig of ram installed)...What finally did the trick for me was switching from ac sparsebands to just acs.......no more core dumping. Has been up for the past week with no problems.
-
I had the same problem for awhile….snort always ending in a core dump. (I have 1 gig of ram installed)...What finally did the trick for me was switching from ac sparsebands to just acs.......no more core dumping. Has been up for the past week with no problems.
;D …and after all that, it looks like acs is the key. certainly been up now for longer than normal, AND it's consuming less memory too
-
I changed my snort performance to acs as well. I am still seeing snort failing to bootup completely immediately after a reboot. However, it will start the initialization process over once it fails. On the second initialization, Snort will successfully boot up.
So I've done some more testing.
Using the performance modes ac, ac-std, or ac-sparebands I get snort initialization failures and core dumps when I reboot. I cannot get snort to boot until I click save in settings.
If I use acs or lowmem, they appear to boot up fine.
Question is, why?
-
It's funny I couldn't figure it either, I tried them all but acs worked consistently well. I'm using about 10% less ram also. The alerts are also triggering consistently better also. I'm running snort+squid, I wonder if all this is related to squid. Did anybody have this problem(core dumping) with just snort installed and not squid?
-
Yep, me. I've only been running SNORT.
Although I will add Squid as soon as it becomes available again.
acs uses significantly less memory for me too and also works as intended. Thank coldfusion
-
Question is, why?
No idea. This is now a SNORT issue and this should be asked on their lists.