Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Snort problem

    Scheduled Pinned Locked Moved pfSense Packages
    104 Posts 21 Posters 48.7k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • S Offline
      simonchs
      last edited by

      i've just reinstalled twice the snort package, but i can't start-up the snort service, here are the log:

      May 26 18:35:47 xxxxx snort[23564]: Initializing daemon mode
      May 26 18:35:47 xxxxx snort[23564]: Initializing daemon mode
      May 26 18:35:47 xxxxx snort[23567]: PID path stat checked out ok, PID path set to /var/run/
      May 26 18:35:47 xxxxx snort[23567]: PID path stat checked out ok, PID path set to /var/run/
      May 26 18:35:47 xxxxx snort[23567]: FATAL ERROR: Failed to Lock PID File "/var/run//snort_em1.pid" for PID "23567"
      May 26 18:35:47 xxxxx snort[23567]: FATAL ERROR: Failed to Lock PID File "/var/run//snort_em1.pid" for PID "23567"
      May 26 18:35:48 xxxxx snort[23564]: Child exited unexpectedly
      May 26 18:35:48 xxxxx snort[23564]: Child exited unexpectedly
      May 26 18:35:48 xxxxx snort[23564]: Daemon parent exiting
      May 26 18:35:48 xxxxx snort[23564]: Daemon parent exiting
      May 26 18:35:56 xxxxx snort2c[23647]: snort2c running in daemon mode pid: 23647
      May 26 18:35:56 xxxxx snort2c[23647]: snort2c running in daemon mode pid: 23647
      May 26 18:36:13 xxxxx SnortStartup[23667]: Ram free BEFORE starting Snort: 59M – Ram free AFTER starting Snort: 59M -- Mode ac-bnfa -- Snort memory usage:

      i've tried to stop the snort service, remove the file /var/run/snort_em1.pid.lck and start the snort service again, and even reboot my pfsense, but got the same log as above.

      any trick?

      1 Reply Last reply Reply Quote 0
      • C Offline
        ColdFusion
        last edited by

        Did you update the rules at all after installation? If not update..should start.

        1 Reply Last reply Reply Quote 0
        • S Offline
          Slam
          last edited by

          Seems to be working great on pfs 1.2.3 w/dual wan & CP, thanks for the update.

          Slam

          1 Reply Last reply Reply Quote 0
          • J Offline
            jamesdean
            last edited by

            @simonchs:

            i've just reinstalled twice the snort package, but i can't start-up the snort service, here are the log:

            May 26 18:35:47 xxxxx snort[23564]: Initializing daemon mode
            May 26 18:35:47 xxxxx snort[23564]: Initializing daemon mode
            May 26 18:35:47 xxxxx snort[23567]: PID path stat checked out ok, PID path set to /var/run/
            May 26 18:35:47 xxxxx snort[23567]: PID path stat checked out ok, PID path set to /var/run/
            May 26 18:35:47 xxxxx snort[23567]: FATAL ERROR: Failed to Lock PID File "/var/run//snort_em1.pid" for PID "23567"
            May 26 18:35:47 xxxxx snort[23567]: FATAL ERROR: Failed to Lock PID File "/var/run//snort_em1.pid" for PID "23567"
            May 26 18:35:48 xxxxx snort[23564]: Child exited unexpectedly
            May 26 18:35:48 xxxxx snort[23564]: Child exited unexpectedly
            May 26 18:35:48 xxxxx snort[23564]: Daemon parent exiting
            May 26 18:35:48 xxxxx snort[23564]: Daemon parent exiting
            May 26 18:35:56 xxxxx snort2c[23647]: snort2c running in daemon mode pid: 23647
            May 26 18:35:56 xxxxx snort2c[23647]: snort2c running in daemon mode pid: 23647
            May 26 18:36:13 xxxxx SnortStartup[23667]: Ram free BEFORE starting Snort: 59M – Ram free AFTER starting Snort: 59M -- Mode ac-bnfa -- Snort memory usage:

            i've tried to stop the snort service, remove the file /var/run/snort_em1.pid.lck and start the snort service again, and even reboot my pfsense, but got the same log as above.

            any trick?

            If any of you are still having problems. Please fallow these steps.

            1. Reinstall snort. (So that the new code gets updated.)

            2. Deinstall snort. (New code deinstalls all the old snort packages.)

            3. Install the snort package.

            4. Update the rules.

            Finished, snort should work now.

            James

            1 Reply Last reply Reply Quote 0
            • S Offline
              simonchs
              last edited by

              @ColdFusion:

              Did you update the rules at all after installation? If not update..should start.

              yes, i've update the rules once the install/re-install complete.

              1 Reply Last reply Reply Quote 0
              • S Offline
                simonchs
                last edited by

                @jamesdean:

                @simonchs:

                i've just reinstalled twice the snort package, but i can't start-up the snort service, here are the log:

                May 26 18:35:47 xxxxx snort[23564]: Initializing daemon mode
                May 26 18:35:47 xxxxx snort[23564]: Initializing daemon mode
                May 26 18:35:47 xxxxx snort[23567]: PID path stat checked out ok, PID path set to /var/run/
                May 26 18:35:47 xxxxx snort[23567]: PID path stat checked out ok, PID path set to /var/run/
                May 26 18:35:47 xxxxx snort[23567]: FATAL ERROR: Failed to Lock PID File "/var/run//snort_em1.pid" for PID "23567"
                May 26 18:35:47 xxxxx snort[23567]: FATAL ERROR: Failed to Lock PID File "/var/run//snort_em1.pid" for PID "23567"
                May 26 18:35:48 xxxxx snort[23564]: Child exited unexpectedly
                May 26 18:35:48 xxxxx snort[23564]: Child exited unexpectedly
                May 26 18:35:48 xxxxx snort[23564]: Daemon parent exiting
                May 26 18:35:48 xxxxx snort[23564]: Daemon parent exiting
                May 26 18:35:56 xxxxx snort2c[23647]: snort2c running in daemon mode pid: 23647
                May 26 18:35:56 xxxxx snort2c[23647]: snort2c running in daemon mode pid: 23647
                May 26 18:36:13 xxxxx SnortStartup[23667]: Ram free BEFORE starting Snort: 59M – Ram free AFTER starting Snort: 59M -- Mode ac-bnfa -- Snort memory usage:

                i've tried to stop the snort service, remove the file /var/run/snort_em1.pid.lck and start the snort service again, and even reboot my pfsense, but got the same log as above.

                any trick?

                If any of you are still having problems. Please fallow these steps.

                1. Reinstall snort. (So that the new code gets updated.)

                2. Deinstall snort. (New code deinstalls all the old snort packages.)

                3. Install the snort package.

                4. Update the rules.

                Finished, snort should work now.

                James

                thanks James, still no luck, same log shown as above post. the "snort" can't start while the "snort2c" can run.

                1 Reply Last reply Reply Quote 0
                • S Offline
                  simonchs
                  last edited by

                  i've just modified /usr/local/etc/rc.d/snort.sh and changed:
                  snort -c /usr/local/etc/snort/snort.conf -l /var/log/snort -D -i em1 -A fast -q
                  to:
                  snort -c /usr/local/etc/snort/snort.conf -l /var/log/snort -i em1 -A fast -q &
                  then the snort work properly

                  is there any way to trace the problem?

                  thanks.

                  1 Reply Last reply Reply Quote 0
                  • F Offline
                    firbc
                    last edited by

                    I have similar problem:

                    snort[1317]: FATAL ERROR: Failed to Lock PID File "/var/run//snort_xl0.pid" for PID "1317"
                    snort[1317]: FATAL ERROR: Failed to Lock PID File "/var/run//snort_xl0.pid" for PID "1317"

                    Also snort do not work after reboot. It starts, it is also loaded to memory but not working.  I have to clean alert logs and after that snort restart itself and then start to work.

                    1 Reply Last reply Reply Quote 0
                    • J Offline
                      jamesdean
                      last edited by

                      Hey firbc, simonchs..

                      Can you guys tell me what version of pfsense your running. I have a feeling its 1.2 and not 1.2.3.

                      Also, please tell me whats the output of "pkg_info".

                      Help me help you.
                      james

                      1 Reply Last reply Reply Quote 0
                      • S Offline
                        simonchs
                        last edited by

                        running pfsense 1.2.2

                        and the output of pkg_info:

                        arc-5.21o_1        Create & extract files from DOS .ARC files
                        arj-3.10.22_1      Open-source ARJ
                        bandwidthd-2.0.1_1  Tracks bandwidth usage by IP address
                        clamav-0.93.1_2    Command line virus scanner written entirely in C
                        gd-2.0.35,1        A graphics library for fast creation of images
                        havp-0.88          HTTP Antivirus Proxy
                        jpeg-6b_4          IJG's jpeg compression utilities
                        lha-1.14i_6        Archive files using LZSS and Huffman compression (.lzh file
                        libdnet-1.11_3      A simple interface to low level networking routines
                        libgmp-4.2.2        A free library for arbitrary precision arithmetic
                        libiconv-1.11_1    A character set conversion library
                        lightsquid-1.7.1_1  A light and fast web based squid proxy traffic analyser
                        mysql-client-5.1.34 Multithreaded SQL database (client)
                        openldap-client-2.4.10 Open source LDAP client implementation
                        openldap-client-2.4.11 Open source LDAP client implementation
                        p5-GD-2.39          A perl5 interface to Gd Graphics Library version2
                        pcre-7.9            Perl Compatible Regular Expressions library
                        perl-5.8.8_1        Practical Extraction and Report Language
                        snort-2.8.4.1      Lightweight network intrusion detection system
                        squid-2.6.21        HTTP Caching Proxy
                        squid_radius_auth-1.10 RADIUS authenticator for squid proxy 2.5 and later
                        unzoo-4.4_2        A zoo archive extractor

                        1 Reply Last reply Reply Quote 0
                        • J Offline
                          jamesdean
                          last edited by

                          Simochs

                          Your setup looks fine.

                          Have you tryed this.
                          Type this in the terminal "rm -r /var/run/snort*"

                          Restart snort.

                          If snort still fails type this in so that I can have a better output of the error.

                          "snort -c /usr/local/etc/snort/snort.conf -l /var/log/snort -v -i ng0 -A fast"

                          Help me help you
                          James

                          1 Reply Last reply Reply Quote 0
                          • S Offline
                            simonchs
                            last edited by

                            yes, i've tried "rm -r /var/run/snort*" and restart snort, still failed.

                            when i type "snort -c /usr/local/etc/snort/snort.conf -l /var/log/snort -v -i ng0 -A fast", snort keep running and do not have error. as my previous modify to /usr/local/etc/rc.d/snort.sh, i can run snort without -D parameter.

                            so i guess the snort binary cannot "daemonize" itself?

                            1 Reply Last reply Reply Quote 0
                            • J Offline
                              jamesdean
                              last edited by

                              That is a realy wierd error ? I have never seen a error in snort were -D is the cause.

                              What version of 1.2.2 do you have scmochs ?

                              Right now Im runing 1.2.3. So im going to have to install 1.2 and retest snort.
                              Then im going to install all your packages and try to reproduce your error.

                              If there are no errors when I install pfsense 1.2 with the new snort package then you need a fresh install, mabe pfsense 1.2.3.

                              Get some sleep, I will figure this out.

                              help me help you
                              rob

                              1 Reply Last reply Reply Quote 0
                              • S Offline
                                simonchs
                                last edited by

                                i'm running pfsense version 1.2.2

                                thanks James

                                1 Reply Last reply Reply Quote 0
                                • J Offline
                                  jamesdean
                                  last edited by

                                  @simonchs:

                                  i'm running pfsense version 1.2.2

                                  thanks James

                                  Theres usually a date like mine says

                                  1.2.3-RC1
                                  built on Wed Apr 22 15:36:34 EDT 2009

                                  1 Reply Last reply Reply Quote 0
                                  • F Offline
                                    firbc
                                    last edited by

                                    @jamesdean:

                                    Hey firbc, simonchs..

                                    Can you guys tell me what version of pfsense your running. I have a feeling its 1.2 and not 1.2.3.

                                    Also, please tell me whats the output of "pkg_info".

                                    Help me help you.
                                    james

                                    I am running version 1.2.3-RC1, built on Fri May 22 16:32:57 EDT 2009 of pfSense.

                                    bandwidthd-2.0.1_1  Tracks bandwidth usage by IP address
                                    gd-2.0.35,1        A graphics library for fast creation of images
                                    grub-0.97_1        GRand Unified Bootloader
                                    jpeg-6b_4          IJG's jpeg compression utilities
                                    libdnet-1.11_3      A simple interface to low level networking routines
                                    libiconv-1.11_1    A character set conversion library
                                    libosip-3.1.0      A low layer of SIP implementation
                                    mysql-client-5.0.77_1 Multithreaded SQL database (client)
                                    mysql-client-5.1.34 Multithreaded SQL database (client)
                                    packages            BSD Installer mega-package
                                    pcre-7.8            Perl Compatible Regular Expressions library
                                    pcre-7.9            Perl Compatible Regular Expressions library
                                    siproxd-0.7.0_1    A proxy/masquerading daemon for the SIP protocol
                                    snort-2.8.4.1      Lightweight network intrusion detection system

                                    Any idea? Thx

                                    1 Reply Last reply Reply Quote 0
                                    • J Offline
                                      jamesdean
                                      last edited by

                                      Fixed the problem waiting for new snort packages to be built.

                                      Please be pationant.

                                      Snort will be working on pfsense 1.2.2 soon.

                                      james

                                      1 Reply Last reply Reply Quote 0
                                      • ? This user is from outside of this forum
                                        Guest
                                        last edited by

                                        Welp i'm having similar problem with snort too.  I reinstalled a fresh copy of pfsense 1.2.2 because i mess it up and when it was running i had snort running beautifully until i reinstall snort after i did a fresh install of pfsense.  Before i install Snort i looked at the platform and it was for 1.2.3 but i was hoping it would work for 1.2.2 but i guess not.  Will the fix be up soon?  I would also like to suggest or request something from the pfsense team to put up multiple applicatoin for different platform so we won't get confuse.
                                        For example:  Snort 1.2.2
                                                          Snort 1.2.3
                                        Instead of a just single update.  Anyhow, you guys are doing a great job and we all appreciated.  Please let us know when the fix is up.  Thanks for everything.  Look foward to the fix.

                                        1 Reply Last reply Reply Quote 0
                                        • L Offline
                                          lordarcane
                                          last edited by

                                          I´ll guess that my problem is related to the fact that I updated snort and now i´m unable to update the rules. Getting md5 signature mismatch and snort refuses to start.

                                          1 Reply Last reply Reply Quote 0
                                          • J Offline
                                            jamesdean
                                            last edited by

                                            @lordarcane:

                                            I´ll guess that my problem is related to the fact that I updated snort and now i´m unable to update the rules. Getting md5 signature mismatch and snort refuses to start.

                                            Thanx for the heads up. Snort.org changed there md5 format to day to go along with there nice new website.

                                            From this > c2844479ed68cc0f13ab61f69e35bc7a

                                            To this >MD5 (snortrules-snapshot-2.8.tar.gz) = c2844479ed68cc0f13ab61f69e35bc7a

                                            Going have to code a fix.
                                            Man Snort Package is killing me this week.
                                            If they change it back after I code a fix, Im going on a vacation ASAP.

                                            james

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.