Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Snort inilization failure

    Scheduled Pinned Locked Moved pfSense Packages
    100 Posts 8 Posters 55.8k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • Y
      yoda715
      last edited by

      If I upgrade to the latest snapshot from 1.0.1 with snort already installed, I get unable to open alert file errors.

      1 Reply Last reply Reply Quote 0
      • Y
        yoda715
        last edited by

        Ok. I am totally perplexed here. I can't get snort running at all now. After upgrading to the 11-29 snapshot last night, I got unable to open snort alert file errors.

        So I reinstalled 1.0.1, did not import config, installed snort, entered the snort code, etc, and now it won't start up.

        I've downloaded the rules, enabled them, etc. Still nothing :(.

        Also, when I upgraded to 11-29 snapshot, it took FOREVER. I'm talking about an hour and a half to upload the file before I got the prompt to install the firmware. I have never gotten that type of response before.

        Anyone else having these issues?

        Here's the log error Im getting with 1.0.1 and snort 2.6.0.2.5

        Nov 30 22:27:46 snort[17160]: Daemon parent exiting
        Nov 30 22:27:46 snort[17160]: Daemon parent exiting
        Nov 30 22:27:46 snort[17160]: Child exited unexpectedly
        Nov 30 22:27:46 snort[17160]: Child exited unexpectedly
        Nov 30 22:27:45 snort[17176]: FATAL ERROR: Failed to Lock PID File "/var/run//snort_sis0.pid" for PID "17176"
        Nov 30 22:27:45 snort[17176]: FATAL ERROR: Failed to Lock PID File "/var/run//snort_sis0.pid" for PID "17176"
        Nov 30 22:27:45 snort[17176]: PID path stat checked out ok, PID path set to /var/run/
        Nov 30 22:27:45 snort[17176]: PID path stat checked out ok, PID path set to /var/run/

        1 Reply Last reply Reply Quote 0
        • S
          sullrich
          last edited by

          Not sure about that one unless FreeBSD 6.2 is causing the issue.  I'm sorta tied up at the moment but will check into it as soon as I get some free cycles.

          1 Reply Last reply Reply Quote 0
          • Y
            yoda715
            last edited by

            PC_Arcade, Coldfusion, are you guys having any troubles getting snort to start in 1.0.1?

            1 Reply Last reply Reply Quote 0
            • P
              PC_Arcade
              last edited by

              Not any more, although it took a complete format and reinstall (without restoring the backed up .conf files) to get it to work.
              Also ACS is the only mode that seems to work reliably for me, try setting that if you haven't already

              1 Reply Last reply Reply Quote 0
              • C
                ColdFusion
                last edited by

                @sdale:

                PC_Arcade, Coldfusion, are you guys having any troubles getting snort to start in 1.0.1?

                I find that if I reboot pfSense, SNORT starts then exits. I have to hit save on the SNORT settings tab to restart SNORT….then it stays up and running. The weird thing is when SNORT exits...I go to the Services tab and it shows that it is running, but it's not. The other thing that I should mention is that if I make any changes to the system, SNORT seems to restart and stays running like it's supposed to. It only seems to happen after a reboot of the system. The good thing though is that it's not core dumping as before.

                1 Reply Last reply Reply Quote 0
                • C
                  ColdFusion
                  last edited by

                  @PC_Arcade:

                  Not any more, although it took a complete format and reinstall (without restoring the backed up .conf files) to get it to work.
                  Also ACS is the only mode that seems to work reliably for me, try setting that if you haven't already

                  Ditto for me….same method

                  1 Reply Last reply Reply Quote 0
                  • Y
                    yoda715
                    last edited by

                    Ok, same here. If I restore config it does not work either. Bill or scott, any idea why that is?

                    1 Reply Last reply Reply Quote 0
                    • Y
                      yoda715
                      last edited by

                      @PC_Arcade:

                      Not any more, although it took a complete format and reinstall (without restoring the backed up .conf files) to get it to work.
                      Also ACS is the only mode that seems to work reliably for me, try setting that if you haven't already

                      Were you able to import your config after you got snort started and snort continue to run?

                      1 Reply Last reply Reply Quote 0
                      • C
                        ColdFusion
                        last edited by

                        Were you able to import your config after you got snort started and snort continue to run?

                        No, originally Iwas getting could not read alert file…I had to re-install pfsense. importing the config did not help.....also in order to keep it running only ACS mode seems to work otherwise you get a core dump.
                        I saved my conf. without the packages, then reinstalled pfsense restoring the config without the SNORT configs. Re-installed Snort and was good to go after that.

                        1 Reply Last reply Reply Quote 0
                        • Y
                          yoda715
                          last edited by

                          @ColdFusion:

                          No, originally Iwas getting could not read alert file…I had to re-install pfsense. importing the config did not help.....also in order to keep it running only ACS mode seems to work otherwise you get a core dump.
                          I saved my conf. without the packages, then reinstalled pfsense restoring the config without the SNORT configs. Re-installed Snort and was good to go after that.

                          Ok. I will try that and see what I get.

                          1 Reply Last reply Reply Quote 0
                          • Y
                            yoda715
                            last edited by

                            I upgraded to snapshot 12-04 and I am not getting anymore failed to open alert file errors. Woot. Although snort will still not startup for me. It just gets in a continuous bootup cycle. I had to uninstall it. It was chewing up my resources :(.

                            Oddly enough, when I uninstalled it, it didnt remove snort. When I rebooted after uninstalling, snort processes booted up. I had to manually remove all snort files to stop this.

                            And also I had to hit reboot twice for my system to reboot. ???

                            Anyone else able to confirm?

                            1 Reply Last reply Reply Quote 0
                            • C
                              ColdFusion
                              last edited by

                              @sdale:

                              I upgraded to snapshot 12-04 and I am not getting anymore failed to open alert file errors. Woot. Although snort will still not startup for me. It just gets in a continuous bootup cycle. I had to uninstall it. It was chewing up my resources :(.

                              Oddly enough, when I uninstalled it, it didnt remove snort. When I rebooted after uninstalling, snort processes booted up. I had to manually remove all snort files to stop this.

                              And also I had to hit reboot twice for my system to reboot. ???

                              Anyone else able to confirm?

                              I upgraded to snapshot 12-04 and it was chewing up my resources also…..memory was running about 8% higher and the CPU was pinned constantly to 100%. I thought maybe it was SNORT because it kept recycling. I also stopped the service but it still kept running and would not kill. I uninstalled SNORT but the processor was still pinned. I rebooted to no avail. I finally resorted back to SNAPSHOT 11-30.....but it was still pinned. I had to restore my config in order for everything to work properly. SNORT now works fine again. The CPU consumption is also back to normal. I'll try upgrading again today and see what happens.

                              1 Reply Last reply Reply Quote 0
                              • Y
                                yoda715
                                last edited by

                                @ColdFusion:

                                @sdale:

                                I upgraded to snapshot 12-04 and I am not getting anymore failed to open alert file errors. Woot. Although snort will still not startup for me. It just gets in a continuous bootup cycle. I had to uninstall it. It was chewing up my resources :(.

                                Oddly enough, when I uninstalled it, it didnt remove snort. When I rebooted after uninstalling, snort processes booted up. I had to manually remove all snort files to stop this.

                                And also I had to hit reboot twice for my system to reboot. ???

                                Anyone else able to confirm?

                                I upgraded to snapshot 12-04 and it was chewing up my resources also…..memory was running about 8% higher and the CPU was pinned constantly to 100%. I thought maybe it was SNORT because it kept recycling. I also stopped the service but it still kept running and would not kill. I uninstalled SNORT but the processor was still pinned. I rebooted to no avail. I finally resorted back to SNAPSHOT 11-30.....but it was still pinned. I had to restore my config in order for everything to work properly. SNORT now works fine again. The CPU consumption is also back to normal. I'll try upgrading again today and see what happens.

                                I reverted back to the 11-30 snapshot as well. Now I'm getting unable to open alert file errors again.

                                1 Reply Last reply Reply Quote 0
                                • S
                                  sullrich
                                  last edited by

                                  Don't forget to save the snort settings after each upgrade/downgrade!

                                  1 Reply Last reply Reply Quote 0
                                  • Y
                                    yoda715
                                    last edited by

                                    @sullrich:

                                    Don't forget to save the snort settings after each upgrade/downgrade!

                                    Yep. I did that. Still getting unable to open alert file with the 11-30 snapshot, and continuous bootup cycle with the 12-4 snapshot.

                                    1 Reply Last reply Reply Quote 0
                                    • Y
                                      yoda715
                                      last edited by

                                      I upgraded to 12-05 snapshot, and when I install snort I get stuck at Executing custom_php_install_command()…

                                      1 Reply Last reply Reply Quote 0
                                      • C
                                        ColdFusion
                                        last edited by

                                        Well I updated to 1.0.1-SNAPSHOT-12-05-2006 and everything seems fine. CPU and memory usage are normal. I guess the upgrade didn't take well the first time. I'll see how this goes.
                                        sdale my alert file problem was resolved by reinstalling pfsense and snort and I haven't been getting the can't open alert file since the 11-25 SNAPSHOT. I just restored my config without the packages. It took all of 15 minutes.

                                        1 Reply Last reply Reply Quote 0
                                        • Y
                                          yoda715
                                          last edited by

                                          Well Im not sure what's going on, but I cant get mine to work. I tried all your suggestions and still nothing. Just keeps exiting :(.

                                          1 Reply Last reply Reply Quote 0
                                          • Y
                                            yoda715
                                            last edited by

                                            Ok, after reformatting like 30 times, I've determined that one or more of the rulesets is causing snort to abort. I'll get back when I determine which one it is.

                                            Update:
                                            OK so I finally got some time to sit down and troubleshoot the crap out of this.
                                            I reformatted to 1.0.1, installed snort, check ALL rulesets, snort would not bootup. Keeps failing, with no error code given.

                                            Using the same install, I finally determined that by un-checking the p2p.rules and web-misc.rule sets I can get snort to bootup.  ???

                                            Now, before you say its a ram issue, its not. With snort up and running, it only consumes 55-60% ram.

                                            To confirm, I tried enabling just those two rules, and snort would not bootup.

                                            I am not sure what in those files is preventing snort from booting up, but something is. Can anyone confirm my evaluation?

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.