Snort inilization failure
-
What snapshot are you running? I'm thinking it has something to do with that since I too reverted back to the older version of snort.
1.0.1-SNAPSHOT-11-19-2006
-
Well, it boiled down to me just re-installing pfSense(1.01) and re-installing SNORT. It started fine. I kept getting could not open alert file…..no matter what I did.......but now (keeping my fingers crossed) everything looks good.
-
I think I'd rather do without snort than re-install from scratch
-
Backup your configuration, reinstall, restore configuration.
It takes about 6 minutes on a 800 mhz machine.
-
If you backup your configuration to a media (floppy/USB stick) to /conf/config.xml your users will only see 2 short downtimes while the pfSense is rebooting. The livecd will come up with your old config and the system will be usable while you are installing it to the hdd ;)
-
Thanks Hoba, I'll give that a try later.
Oh, Fyi everyone, I've taken on a little issue I saw with snort. I've been wanting an easy way to enable, disable, and edit snort rules. So I've started workin on this. It's not done yet, but the screenshot below shows the progress I've made in the last day.
Right now I've got it to list the rules in a cleaner format, but they are not yet editable.
Enjoy.
![snort rules.JPG](/public/imported_attachments/1/snort rules.JPG)
![snort rules.JPG_thumb](/public/imported_attachments/1/snort rules.JPG_thumb)
![snort rules.JPG_thumb](/public/imported_attachments/1/snort rules.JPG_thumb) -
Thanks Hoba, I'll give that a try later.
Oh, Fyi everyone, I've taken on a little issue I saw with snort. I've been wanting an easy way to enable, disable, and edit snort rules. So I've started workin on this. It's not done yet, but the screenshot below shows the progress I've made in the last day.
Right now I've got it to list the rules in a cleaner format, but they are not yet editable.
Enjoy.
Nice!
-
Thanks. I plan on having it look very similar to the firewall rules. Right now functionality is what I am focusing on. Then I will make it look pretty :).
-
~~No go for me.
I've tried everything.
Fresh install of 1.0.1. No config file uploaded. Downloaded snort, enter info, and nothing starts up. I'm not getting the error "can't read alert file", but snort is not starting up.~~
Nevermind, it helps to enable rules. all good now :).
-
If I upgrade to the latest snapshot from 1.0.1 with snort already installed, I get unable to open alert file errors.
-
Ok. I am totally perplexed here. I can't get snort running at all now. After upgrading to the 11-29 snapshot last night, I got unable to open snort alert file errors.
So I reinstalled 1.0.1, did not import config, installed snort, entered the snort code, etc, and now it won't start up.
I've downloaded the rules, enabled them, etc. Still nothing :(.
Also, when I upgraded to 11-29 snapshot, it took FOREVER. I'm talking about an hour and a half to upload the file before I got the prompt to install the firmware. I have never gotten that type of response before.
Anyone else having these issues?
Here's the log error Im getting with 1.0.1 and snort 2.6.0.2.5
Nov 30 22:27:46 snort[17160]: Daemon parent exiting
Nov 30 22:27:46 snort[17160]: Daemon parent exiting
Nov 30 22:27:46 snort[17160]: Child exited unexpectedly
Nov 30 22:27:46 snort[17160]: Child exited unexpectedly
Nov 30 22:27:45 snort[17176]: FATAL ERROR: Failed to Lock PID File "/var/run//snort_sis0.pid" for PID "17176"
Nov 30 22:27:45 snort[17176]: FATAL ERROR: Failed to Lock PID File "/var/run//snort_sis0.pid" for PID "17176"
Nov 30 22:27:45 snort[17176]: PID path stat checked out ok, PID path set to /var/run/
Nov 30 22:27:45 snort[17176]: PID path stat checked out ok, PID path set to /var/run/ -
Not sure about that one unless FreeBSD 6.2 is causing the issue. I'm sorta tied up at the moment but will check into it as soon as I get some free cycles.
-
PC_Arcade, Coldfusion, are you guys having any troubles getting snort to start in 1.0.1?
-
Not any more, although it took a complete format and reinstall (without restoring the backed up .conf files) to get it to work.
Also ACS is the only mode that seems to work reliably for me, try setting that if you haven't already -
@sdale:
PC_Arcade, Coldfusion, are you guys having any troubles getting snort to start in 1.0.1?
I find that if I reboot pfSense, SNORT starts then exits. I have to hit save on the SNORT settings tab to restart SNORT….then it stays up and running. The weird thing is when SNORT exits...I go to the Services tab and it shows that it is running, but it's not. The other thing that I should mention is that if I make any changes to the system, SNORT seems to restart and stays running like it's supposed to. It only seems to happen after a reboot of the system. The good thing though is that it's not core dumping as before.
-
Not any more, although it took a complete format and reinstall (without restoring the backed up .conf files) to get it to work.
Also ACS is the only mode that seems to work reliably for me, try setting that if you haven't alreadyDitto for me….same method
-
Ok, same here. If I restore config it does not work either. Bill or scott, any idea why that is?
-
Not any more, although it took a complete format and reinstall (without restoring the backed up .conf files) to get it to work.
Also ACS is the only mode that seems to work reliably for me, try setting that if you haven't alreadyWere you able to import your config after you got snort started and snort continue to run?
-
Were you able to import your config after you got snort started and snort continue to run?
No, originally Iwas getting could not read alert file…I had to re-install pfsense. importing the config did not help.....also in order to keep it running only ACS mode seems to work otherwise you get a core dump.
I saved my conf. without the packages, then reinstalled pfsense restoring the config without the SNORT configs. Re-installed Snort and was good to go after that. -
No, originally Iwas getting could not read alert file…I had to re-install pfsense. importing the config did not help.....also in order to keep it running only ACS mode seems to work otherwise you get a core dump.
I saved my conf. without the packages, then reinstalled pfsense restoring the config without the SNORT configs. Re-installed Snort and was good to go after that.Ok. I will try that and see what I get.