• Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login
Netgate Discussion Forum
  • Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login

Snort inilization failure

Scheduled Pinned Locked Moved pfSense Packages
100 Posts 8 Posters 52.8k Views
Loading More Posts
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • C
    ColdFusion
    last edited by Nov 21, 2006, 4:11 AM

    I had the same problem for awhile….snort always ending in a core dump. (I have 1 gig of ram installed)...What finally did the trick for me was switching from ac sparsebands to just acs.......no more core dumping. Has been up for the past week with no problems.

    1 Reply Last reply Reply Quote 0
    • P
      PC_Arcade
      last edited by Nov 21, 2006, 7:05 AM

      @ColdFusion:

      I had the same problem for awhile….snort always ending in a core dump. (I have 1 gig of ram installed)...What finally did the trick for me was switching from ac sparsebands to just acs.......no more core dumping. Has been up for the past week with no problems.

      ;D …and after all that, it looks like acs is the key. certainly been up now for longer than normal, AND it's consuming less memory too

      1 Reply Last reply Reply Quote 0
      • Y
        yoda715
        last edited by Nov 21, 2006, 7:28 AM

        I changed my snort performance to acs as well. I am still seeing snort failing to bootup completely immediately after a reboot. However, it will start the initialization process over once it fails. On the second initialization, Snort will successfully boot up.

        So I've done some more testing.

        Using the performance modes ac, ac-std, or ac-sparebands I get snort initialization failures and core dumps when I reboot. I cannot get snort to boot until I click save in settings.

        If I use acs or lowmem, they appear to boot up fine.

        Question is, why?

        1 Reply Last reply Reply Quote 0
        • C
          ColdFusion
          last edited by Nov 21, 2006, 11:08 AM

          It's funny I couldn't figure it either, I tried them all but acs worked consistently well. I'm using about 10% less ram also. The alerts are also triggering consistently better also. I'm running snort+squid, I wonder if all this is related to squid. Did anybody have this problem(core dumping) with just snort installed and not squid?

          1 Reply Last reply Reply Quote 0
          • P
            PC_Arcade
            last edited by Nov 21, 2006, 11:21 AM

            Yep, me. I've only been running SNORT.

            Although I will add Squid as soon as it becomes available again.

            acs uses significantly less memory for me too and also works as intended. Thank coldfusion

            1 Reply Last reply Reply Quote 0
            • S
              sullrich
              last edited by Nov 21, 2006, 3:37 PM

              @yoda715:

              Question is, why?

              No idea.  This is now a SNORT issue and this should be asked on their lists.

              1 Reply Last reply Reply Quote 0
              • P
                PC_Arcade
                last edited by Nov 23, 2006, 5:50 PM

                I think the latest version of SNORT (2.6.1.1) fixes this issue

                1 Reply Last reply Reply Quote 0
                • Y
                  yoda715
                  last edited by Nov 23, 2006, 7:44 PM Nov 23, 2006, 6:56 PM

                  Not sure if this fixes our issue.

                  This is the issue solved in 2.6.1.1: "Fix problem with snort using high CPU and reprocessing the same rebuilt packets at session end or ACK in middle of packet when there are gaps in the packet sequence."

                  1 Reply Last reply Reply Quote 0
                  • P
                    PC_Arcade
                    last edited by Nov 24, 2006, 12:44 PM

                    certainly seems to :)

                    Running in sparsebands now, only been up for ~5 minutes, but that's ~3 more than I've managed before

                    1 Reply Last reply Reply Quote 0
                    • Y
                      yoda715
                      last edited by Nov 24, 2006, 9:03 PM Nov 24, 2006, 7:41 PM

                      I updated to the 2.6.1.1 versions and now I cant even get Snort to boot up on any performance setting. I am getting brand new errors now:

                      Nov 24 14:53:39 snort2c[1571]: unable to open alertfile - exit
                      Nov 24 14:53:39 snort2c[1571]: unable to open alertfile - exit
                      Nov 24 14:53:39 snort2c[1571]: snort2c running in daemon mode pid: 1571
                      Nov 24 14:53:39 snort2c[1571]: snort2c running in daemon mode pid: 1571

                      I am running the 1.0.1-SNAPSHOT-11-24-2006

                      1 Reply Last reply Reply Quote 0
                      • S
                        sullrich
                        last edited by Nov 24, 2006, 10:42 PM

                        Oh bugger.  I'll check it out a bit later tonite.

                        1 Reply Last reply Reply Quote 0
                        • Y
                          yoda715
                          last edited by Nov 24, 2006, 11:01 PM

                          Thanks Scott.

                          1 Reply Last reply Reply Quote 0
                          • P
                            PC_Arcade
                            last edited by Nov 25, 2006, 12:19 AM

                            Didn't do that for me, BUT it also didn't trigger any alerts

                            1 Reply Last reply Reply Quote 0
                            • Y
                              yoda715
                              last edited by Nov 25, 2006, 12:28 AM

                              Try running a port scan from http://www.grc.com. You should see it appear in alert as a ping.

                              1 Reply Last reply Reply Quote 0
                              • C
                                ColdFusion
                                last edited by Nov 25, 2006, 3:12 AM

                                I'm pretty much screwed with the same alert after I upgraded SNORT. Now the service will not start and stay running.

                                1 Reply Last reply Reply Quote 0
                                • Y
                                  yoda715
                                  last edited by Nov 25, 2006, 9:20 AM

                                  Scott, I see where you reverted snort back to the 2.6.0.2.5. I reverted back to that version and I'm still getting the same error. The trouble must be in the latest snapshot.

                                  1 Reply Last reply Reply Quote 0
                                  • P
                                    PC_Arcade
                                    last edited by Nov 25, 2006, 10:09 AM Nov 25, 2006, 10:06 AM

                                    @yoda715:

                                    Try running a port scan from http://www.grc.com. You should see it appear in alert as a ping.

                                    I know, and it doesn't.

                                    I've reverted back to the older version and it still doesn't raise any alerts at all  ???

                                    1 Reply Last reply Reply Quote 0
                                    • Y
                                      yoda715
                                      last edited by Nov 25, 2006, 12:04 PM

                                      What snapshot are you running? I'm thinking it has something to do with that since I too reverted back to the older version of snort.

                                      1 Reply Last reply Reply Quote 0
                                      • C
                                        ColdFusion
                                        last edited by Nov 25, 2006, 12:19 PM

                                        Version 1.01

                                        1 Reply Last reply Reply Quote 0
                                        • P
                                          PC_Arcade
                                          last edited by Nov 25, 2006, 1:09 PM

                                          @yoda715:

                                          What snapshot are you running? I'm thinking it has something to do with that since I too reverted back to the older version of snort.

                                          1.0.1-SNAPSHOT-11-19-2006

                                          1 Reply Last reply Reply Quote 0
                                          58 out of 100
                                          • First post
                                            58/100
                                            Last post
                                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.
                                            This community forum collects and processes your personal information.
                                            consent.not_received