Snort problem
-
i've just reinstalled twice the snort package, but i can't start-up the snort service, here are the log:
May 26 18:35:47 xxxxx snort[23564]: Initializing daemon mode
May 26 18:35:47 xxxxx snort[23564]: Initializing daemon mode
May 26 18:35:47 xxxxx snort[23567]: PID path stat checked out ok, PID path set to /var/run/
May 26 18:35:47 xxxxx snort[23567]: PID path stat checked out ok, PID path set to /var/run/
May 26 18:35:47 xxxxx snort[23567]: FATAL ERROR: Failed to Lock PID File "/var/run//snort_em1.pid" for PID "23567"
May 26 18:35:47 xxxxx snort[23567]: FATAL ERROR: Failed to Lock PID File "/var/run//snort_em1.pid" for PID "23567"
May 26 18:35:48 xxxxx snort[23564]: Child exited unexpectedly
May 26 18:35:48 xxxxx snort[23564]: Child exited unexpectedly
May 26 18:35:48 xxxxx snort[23564]: Daemon parent exiting
May 26 18:35:48 xxxxx snort[23564]: Daemon parent exiting
May 26 18:35:56 xxxxx snort2c[23647]: snort2c running in daemon mode pid: 23647
May 26 18:35:56 xxxxx snort2c[23647]: snort2c running in daemon mode pid: 23647
May 26 18:36:13 xxxxx SnortStartup[23667]: Ram free BEFORE starting Snort: 59M – Ram free AFTER starting Snort: 59M -- Mode ac-bnfa -- Snort memory usage:i've tried to stop the snort service, remove the file /var/run/snort_em1.pid.lck and start the snort service again, and even reboot my pfsense, but got the same log as above.
any trick?
If any of you are still having problems. Please fallow these steps.
1. Reinstall snort. (So that the new code gets updated.)
2. Deinstall snort. (New code deinstalls all the old snort packages.)
3. Install the snort package.
4. Update the rules.
Finished, snort should work now.
James
-
Did you update the rules at all after installation? If not update..should start.
yes, i've update the rules once the install/re-install complete.
-
i've just reinstalled twice the snort package, but i can't start-up the snort service, here are the log:
May 26 18:35:47 xxxxx snort[23564]: Initializing daemon mode
May 26 18:35:47 xxxxx snort[23564]: Initializing daemon mode
May 26 18:35:47 xxxxx snort[23567]: PID path stat checked out ok, PID path set to /var/run/
May 26 18:35:47 xxxxx snort[23567]: PID path stat checked out ok, PID path set to /var/run/
May 26 18:35:47 xxxxx snort[23567]: FATAL ERROR: Failed to Lock PID File "/var/run//snort_em1.pid" for PID "23567"
May 26 18:35:47 xxxxx snort[23567]: FATAL ERROR: Failed to Lock PID File "/var/run//snort_em1.pid" for PID "23567"
May 26 18:35:48 xxxxx snort[23564]: Child exited unexpectedly
May 26 18:35:48 xxxxx snort[23564]: Child exited unexpectedly
May 26 18:35:48 xxxxx snort[23564]: Daemon parent exiting
May 26 18:35:48 xxxxx snort[23564]: Daemon parent exiting
May 26 18:35:56 xxxxx snort2c[23647]: snort2c running in daemon mode pid: 23647
May 26 18:35:56 xxxxx snort2c[23647]: snort2c running in daemon mode pid: 23647
May 26 18:36:13 xxxxx SnortStartup[23667]: Ram free BEFORE starting Snort: 59M – Ram free AFTER starting Snort: 59M -- Mode ac-bnfa -- Snort memory usage:i've tried to stop the snort service, remove the file /var/run/snort_em1.pid.lck and start the snort service again, and even reboot my pfsense, but got the same log as above.
any trick?
If any of you are still having problems. Please fallow these steps.
1. Reinstall snort. (So that the new code gets updated.)
2. Deinstall snort. (New code deinstalls all the old snort packages.)
3. Install the snort package.
4. Update the rules.
Finished, snort should work now.
James
thanks James, still no luck, same log shown as above post. the "snort" can't start while the "snort2c" can run.
-
i've just modified /usr/local/etc/rc.d/snort.sh and changed:
snort -c /usr/local/etc/snort/snort.conf -l /var/log/snort -D -i em1 -A fast -q
to:
snort -c /usr/local/etc/snort/snort.conf -l /var/log/snort -i em1 -A fast -q &
then the snort work properlyis there any way to trace the problem?
thanks.
-
I have similar problem:
snort[1317]: FATAL ERROR: Failed to Lock PID File "/var/run//snort_xl0.pid" for PID "1317"
snort[1317]: FATAL ERROR: Failed to Lock PID File "/var/run//snort_xl0.pid" for PID "1317"Also snort do not work after reboot. It starts, it is also loaded to memory but not working. I have to clean alert logs and after that snort restart itself and then start to work.
-
Hey firbc, simonchs..
Can you guys tell me what version of pfsense your running. I have a feeling its 1.2 and not 1.2.3.
Also, please tell me whats the output of "pkg_info".
Help me help you.
james -
running pfsense 1.2.2
and the output of pkg_info:
arc-5.21o_1 Create & extract files from DOS .ARC files
arj-3.10.22_1 Open-source ARJ
bandwidthd-2.0.1_1 Tracks bandwidth usage by IP address
clamav-0.93.1_2 Command line virus scanner written entirely in C
gd-2.0.35,1 A graphics library for fast creation of images
havp-0.88 HTTP Antivirus Proxy
jpeg-6b_4 IJG's jpeg compression utilities
lha-1.14i_6 Archive files using LZSS and Huffman compression (.lzh file
libdnet-1.11_3 A simple interface to low level networking routines
libgmp-4.2.2 A free library for arbitrary precision arithmetic
libiconv-1.11_1 A character set conversion library
lightsquid-1.7.1_1 A light and fast web based squid proxy traffic analyser
mysql-client-5.1.34 Multithreaded SQL database (client)
openldap-client-2.4.10 Open source LDAP client implementation
openldap-client-2.4.11 Open source LDAP client implementation
p5-GD-2.39 A perl5 interface to Gd Graphics Library version2
pcre-7.9 Perl Compatible Regular Expressions library
perl-5.8.8_1 Practical Extraction and Report Language
snort-2.8.4.1 Lightweight network intrusion detection system
squid-2.6.21 HTTP Caching Proxy
squid_radius_auth-1.10 RADIUS authenticator for squid proxy 2.5 and later
unzoo-4.4_2 A zoo archive extractor -
Simochs
Your setup looks fine.
Have you tryed this.
Type this in the terminal "rm -r /var/run/snort*"Restart snort.
If snort still fails type this in so that I can have a better output of the error.
"snort -c /usr/local/etc/snort/snort.conf -l /var/log/snort -v -i ng0 -A fast"
Help me help you
James -
yes, i've tried "rm -r /var/run/snort*" and restart snort, still failed.
when i type "snort -c /usr/local/etc/snort/snort.conf -l /var/log/snort -v -i ng0 -A fast", snort keep running and do not have error. as my previous modify to /usr/local/etc/rc.d/snort.sh, i can run snort without -D parameter.
so i guess the snort binary cannot "daemonize" itself?
-
That is a realy wierd error ? I have never seen a error in snort were -D is the cause.
What version of 1.2.2 do you have scmochs ?
Right now Im runing 1.2.3. So im going to have to install 1.2 and retest snort.
Then im going to install all your packages and try to reproduce your error.If there are no errors when I install pfsense 1.2 with the new snort package then you need a fresh install, mabe pfsense 1.2.3.
Get some sleep, I will figure this out.
help me help you
rob -
i'm running pfsense version 1.2.2
thanks James
-
i'm running pfsense version 1.2.2
thanks James
Theres usually a date like mine says
1.2.3-RC1
built on Wed Apr 22 15:36:34 EDT 2009 -
Hey firbc, simonchs..
Can you guys tell me what version of pfsense your running. I have a feeling its 1.2 and not 1.2.3.
Also, please tell me whats the output of "pkg_info".
Help me help you.
jamesI am running version 1.2.3-RC1, built on Fri May 22 16:32:57 EDT 2009 of pfSense.
bandwidthd-2.0.1_1 Tracks bandwidth usage by IP address
gd-2.0.35,1 A graphics library for fast creation of images
grub-0.97_1 GRand Unified Bootloader
jpeg-6b_4 IJG's jpeg compression utilities
libdnet-1.11_3 A simple interface to low level networking routines
libiconv-1.11_1 A character set conversion library
libosip-3.1.0 A low layer of SIP implementation
mysql-client-5.0.77_1 Multithreaded SQL database (client)
mysql-client-5.1.34 Multithreaded SQL database (client)
packages BSD Installer mega-package
pcre-7.8 Perl Compatible Regular Expressions library
pcre-7.9 Perl Compatible Regular Expressions library
siproxd-0.7.0_1 A proxy/masquerading daemon for the SIP protocol
snort-2.8.4.1 Lightweight network intrusion detection systemAny idea? Thx
-
Fixed the problem waiting for new snort packages to be built.
Please be pationant.
Snort will be working on pfsense 1.2.2 soon.
james
-
Welp i'm having similar problem with snort too. I reinstalled a fresh copy of pfsense 1.2.2 because i mess it up and when it was running i had snort running beautifully until i reinstall snort after i did a fresh install of pfsense. Before i install Snort i looked at the platform and it was for 1.2.3 but i was hoping it would work for 1.2.2 but i guess not. Will the fix be up soon? I would also like to suggest or request something from the pfsense team to put up multiple applicatoin for different platform so we won't get confuse.
For example: Snort 1.2.2
Snort 1.2.3
Instead of a just single update. Anyhow, you guys are doing a great job and we all appreciated. Please let us know when the fix is up. Thanks for everything. Look foward to the fix. -
I´ll guess that my problem is related to the fact that I updated snort and now i´m unable to update the rules. Getting md5 signature mismatch and snort refuses to start.
-
I´ll guess that my problem is related to the fact that I updated snort and now i´m unable to update the rules. Getting md5 signature mismatch and snort refuses to start.
Thanx for the heads up. Snort.org changed there md5 format to day to go along with there nice new website.
From this > c2844479ed68cc0f13ab61f69e35bc7a
To this >MD5 (snortrules-snapshot-2.8.tar.gz) = c2844479ed68cc0f13ab61f69e35bc7a
Going have to code a fix.
Man Snort Package is killing me this week.
If they change it back after I code a fix, Im going on a vacation ASAP.james
-
My thanks to JamesDean and anyone else working on this problem. I know others appreciate the hard work done with this and all other packages. It's not a easy task keeping up with technology, or life for that matter.
Thanks!
-
So has there been a fix?
-
Waiting for the MD5 fix as well :)
TIA!