• Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login
Netgate Discussion Forum
  • Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login

Snort inilization failure

Scheduled Pinned Locked Moved pfSense Packages
100 Posts 8 Posters 52.8k Views
Loading More Posts
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • Y
    yoda715
    last edited by Nov 1, 2006, 3:24 AM

    With the 1.0.1 update installed snort will not startup properly after a reboot of pfsense. I have snort running in ac-sparsebands mode. I get a snort inilization error failed in the system log. The only way to get Snort to startup after the reboot is to click 'Save' under 'Snort settings'. Anyone else noticed this issue?

    1 Reply Last reply Reply Quote 0
    • S
      sullrich
      last edited by Nov 1, 2006, 3:32 AM

      Just installed 1.0.1 in a vmware vm and then installed snort, configured and rebooted.  Each time snort was started as it should be.

      1 Reply Last reply Reply Quote 0
      • Y
        yoda715
        last edited by Nov 1, 2006, 3:36 AM

        Hmm. Odd. I just rebooted again and it worked. I swear it didn't work last time. I will see if I can find the pattern to reproduce it.

        1 Reply Last reply Reply Quote 0
        • Y
          yoda715
          last edited by Nov 1, 2006, 3:39 AM

          Ignore my previous post, it did it again after a few minutes. After about 5 minutes of up time, the snort process exits. Here's the log:

          Last 200 system log entries
          Oct 31 22:49:35 snort[968]: Snort exiting
          Oct 31 22:49:35 snort[968]: Snort exiting
          Oct 31 22:49:35 kernel: rl1: promiscuous mode disabled
          Oct 31 22:49:35 snort[968]: ===============================================================================
          Oct 31 22:49:35 snort[968]: ===============================================================================
          Oct 31 22:49:35 snort[968]: PASSED: 0
          Oct 31 22:49:35 snort[968]: PASSED: 0
          Oct 31 22:49:35 snort[968]: LOGGED: 0
          Oct 31 22:49:35 snort[968]: LOGGED: 0
          Oct 31 22:49:35 snort[968]: ALERTS: 0
          Oct 31 22:49:35 snort[968]: ALERTS: 0
          Oct 31 22:49:35 snort[968]: Action Stats:
          Oct 31 22:49:35 snort[968]: Action Stats:
          Oct 31 22:49:35 snort[968]: ===============================================================================
          Oct 31 22:49:35 snort[968]: ===============================================================================
          Oct 31 22:49:35 snort[968]: DISCARD: 0 (0.000%)
          Oct 31 22:49:35 snort[968]: DISCARD: 0 (0.000%)
          Oct 31 22:49:35 snort[968]: OTHER: 0 (0.000%)
          Oct 31 22:49:35 snort[968]: OTHER: 0 (0.000%)
          Oct 31 22:49:35 snort[968]: FRAG: 0 (0.000%)
          Oct 31 22:49:35 snort[968]: FRAG: 0 (0.000%)
          Oct 31 22:49:35 snort[968]: IPX: 0 (0.000%)
          Oct 31 22:49:35 snort[968]: IPX: 0 (0.000%)
          Oct 31 22:49:35 snort[968]: ETHLOOP: 0 (0.000%)
          Oct 31 22:49:35 snort[968]: ETHLOOP: 0 (0.000%)
          Oct 31 22:49:35 snort[968]: IPv6: 0 (0.000%)
          Oct 31 22:49:35 snort[968]: IPv6: 0 (0.000%)
          Oct 31 22:49:35 snort[968]: EAPOL: 0 (0.000%)
          Oct 31 22:49:35 snort[968]: EAPOL: 0 (0.000%)
          Oct 31 22:49:35 snort[968]: ARP: 0 (0.000%)
          Oct 31 22:49:35 snort[968]: ARP: 0 (0.000%)
          Oct 31 22:49:35 snort[968]: ICMP: 0 (0.000%)
          Oct 31 22:49:35 snort[968]: ICMP: 0 (0.000%)
          Oct 31 22:49:35 snort[968]: UDP: 0 (0.000%)
          Oct 31 22:49:35 snort[968]: UDP: 0 (0.000%)
          Oct 31 22:49:35 snort[968]: TCP: 0 (0.000%)
          Oct 31 22:49:35 snort[968]: TCP: 0 (0.000%)
          Oct 31 22:49:35 snort[968]: Breakdown by protocol:
          Oct 31 22:49:35 snort[968]: Breakdown by protocol:
          Oct 31 22:49:35 snort[968]: ===============================================================================
          Oct 31 22:49:35 snort[968]: ===============================================================================
          Oct 31 22:49:35 snort[968]: Outstanding: 250(8.648%)
          Oct 31 22:49:35 snort[968]: Outstanding: 250(8.648%)
          Oct 31 22:49:35 snort[968]: Dropped: 2641(91.352%)
          Oct 31 22:49:35 snort[968]: Dropped: 2641(91.352%)
          Oct 31 22:49:35 snort[968]: Analyzed: 0(0.000%)
          Oct 31 22:49:35 snort[968]: Analyzed: 0(0.000%)
          Oct 31 22:49:35 snort[968]: Snort received 2891 packets
          Oct 31 22:49:35 snort[968]: Snort received 2891 packets
          Oct 31 22:49:35 snort[968]: –----------------------------- Oct 31 22:49:35 snort[968]: –-----------------------------
          Oct 31 22:49:35 snort[968]: Recovered Nodes: 0
          Oct 31 22:49:35 snort[968]: Recovered Nodes: 0
          Oct 31 22:49:35 snort[968]: Nodes: 0
          Oct 31 22:49:35 snort[968]: Nodes: 0
          Oct 31 22:49:35 snort[968]: Finds: 0 (Sucessful: 0(%0.000000) Unsucessful: 0(%0.000000))
          Oct 31 22:49:35 snort[968]: Finds: 0 (Sucessful: 0(%0.000000) Unsucessful: 0(%0.000000))
          Oct 31 22:49:35 snort[968]: Memcap: 2097152 Overhead Bytes: 262152
          Oct 31 22:49:35 snort[968]: Memcap: 2097152 Overhead Bytes: 262152
          Oct 31 22:49:35 snort[968]: ,–---[SERVER STATS]–----------
          Oct 31 22:49:35 snort[968]: ,–---[SERVER STATS]–----------
          Oct 31 22:49:35 snort[968]: Recovered Nodes: 0
          Oct 31 22:49:35 snort[968]: Recovered Nodes: 0
          Oct 31 22:49:35 snort[968]: Nodes: 0
          Oct 31 22:49:35 snort[968]: Nodes: 0
          Oct 31 22:49:35 snort[968]: Finds: 0 (Sucessful: 0(%0.000000) Unsucessful: 0(%0.000000))
          Oct 31 22:49:35 snort[968]: Finds: 0 (Sucessful: 0(%0.000000) Unsucessful: 0(%0.000000))
          Oct 31 22:49:35 snort[968]: Memcap: 25165824 Overhead Bytes: 4000016
          Oct 31 22:49:35 snort[968]: Memcap: 25165824 Overhead Bytes: 4000016
          Oct 31 22:49:35 snort[968]: UNIQUE_TRACKER STATS
          Oct 31 22:49:35 snort[968]: UNIQUE_TRACKER STATS
          Oct 31 22:49:35 snort[968]: Score Entry Size:: 112
          Oct 31 22:49:35 snort[968]: Score Entry Size:: 112
          Oct 31 22:49:35 snort[968]: Recovered Nodes: 0
          Oct 31 22:49:35 snort[968]: Recovered Nodes: 0
          Oct 31 22:49:35 snort[968]: Nodes: 0
          Oct 31 22:49:35 snort[968]: Nodes: 0
          Oct 31 22:49:35 snort[968]: Finds: 0 (Sucessful: 0(%0.000000) Unsucessful: 0(%0.000000))
          Oct 31 22:49:35 snort[968]: Finds: 0 (Sucessful: 0(%0.000000) Unsucessful: 0(%0.000000))
          Oct 31 22:49:35 snort[968]: Memcap: 6291456 Overhead Bytes: 1000032
          Oct 31 22:49:35 snort[968]: Memcap: 6291456 Overhead Bytes: 1000032
          Oct 31 22:49:35 snort[968]: SCOREBOARD_STATS: Portscanners
          Oct 31 22:49:35 snort[968]: SCOREBOARD_STATS: Portscanners
          Oct 31 22:49:35 snort[968]: Score Entry Size:: 112
          Oct 31 22:49:35 snort[968]: Score Entry Size:: 112
          Oct 31 22:49:35 snort[968]: Recovered Nodes: 0
          Oct 31 22:49:35 snort[968]: Recovered Nodes: 0
          Oct 31 22:49:35 snort[968]: Nodes: 0
          Oct 31 22:49:35 snort[968]: Nodes: 0
          Oct 31 22:49:35 snort[968]: Finds: 0 (Sucessful: 0(%0.000000) Unsucessful: 0(%0.000000))
          Oct 31 22:49:35 snort[968]: Finds: 0 (Sucessful: 0(%0.000000) Unsucessful: 0(%0.000000))
          Oct 31 22:49:35 snort[968]: Memcap: 25165824 Overhead Bytes: 120048
          Oct 31 22:49:35 snort[968]: Memcap: 25165824 Overhead Bytes: 120048
          Oct 31 22:49:35 snort[968]: SCOREBOARD_STATS: Active Talkers
          Oct 31 22:49:35 snort[968]: SCOREBOARD_STATS: Active Talkers
          Oct 31 22:49:35 snort[968]: +–-[ Flow-portscan Stats ]–--------------+
          Oct 31 22:49:35 snort[968]: +–-[ Flow-portscan Stats ]–--------------+
          Oct 31 22:49:35 snort[968]: finds: 0 reversed: 0(%0.000000) find_success: 0 find_fail: 0 percent_success: (%0.000000) new_flows: 0
          Oct 31 22:49:35 snort[968]: finds: 0 reversed: 0(%0.000000) find_success: 0 find_fail: 0 percent_success: (%0.000000) new_flows: 0
          Oct 31 22:49:35 snort[968]: IPV4 count: 0 frees: 0 low_time: 0, high_time: 0, diff: 0h:00:00s
          Oct 31 22:49:35 snort[968]: IPV4 count: 0 frees: 0 low_time: 0, high_time: 0, diff: 0h:00:00s
          Oct 31 22:49:35 snort[968]: Memcap: 10485760 Overhead Bytes 16400 used(%0.156403)/blocks (16400/1) Overhead blocks: 1 Could Hold: (0)
          Oct 31 22:49:35 snort[968]: Memcap: 10485760 Overhead Bytes 16400 used(%0.156403)/blocks (16400/1) Overhead blocks: 1 Could Hold: (0)
          Oct 31 22:49:35 snort[968]: ,–--[ FLOWCACHE STATS ]–--------
          Oct 31 22:49:35 snort[968]: ,–--[ FLOWCACHE STATS ]–--------
          Oct 31 22:49:35 snort[968]: Final Flow Statistics
          Oct 31 22:49:35 snort[968]: Final Flow Statistics
          Oct 31 22:49:35 snort[968]: *** Caught Term-Signal
          Oct 31 22:49:35 snort[968]: *** Caught Term-Signal
          Oct 31 22:49:35 snort[968]: Not Using PCAP_FRAMES
          Oct 31 22:49:35 snort[968]: Not Using PCAP_FRAMES
          Oct 31 22:49:35 snort[968]: Snort initialization completed successfully (pid=968)
          Oct 31 22:49:35 snort[968]: Snort initialization completed successfully (pid=968)
          Oct 31 22:49:33 kernel: stray irq7
          Oct 31 22:49:27 kernel: stray irq7
          Oct 31 22:47:59 php: : phpDynDNS: No Change In My IP Address and/or 25 Days Has Not Past. Not Updating Dynamic DNS Entry.
          Oct 31 22:47:59 php: : DynDns: Cached IP: *********
          Oct 31 22:47:59 php: : DynDns: Current WAN IP: *********
          Oct 31 22:47:59 php: : DynDns: _detectChange() starting.
          Oct 31 22:47:59 php: : DynDns: updatedns() starting
          Oct 31 22:47:59 php: : DynDns: Running updatedns()
          Oct 31 22:47:50 check_reload_status: updating dyndns
          Oct 31 22:47:50 php: : [SNORT] Snort_dynamic_ip_reload.php is starting.
          Oct 31 22:47:14 SnortStartup[1307]: Ram free BEFORE starting Snort: 16M – Ram free AFTER starting Snort: 270M -- Mode ac-sparsebands -- Snort memory usage:
          Oct 31 22:46:57 snort2c[1254]: snort2c running in daemon mode pid: 1254
          Oct 31 22:46:57 snort2c[1254]: snort2c running in daemon mode pid: 1254
          Oct 31 22:46:57 snort[1198]: Daemon parent exiting
          Oct 31 22:46:57 snort[1198]: Daemon parent exiting
          Oct 31 22:46:56 snort[1198]: Child exited unexpectedly
          Oct 31 22:46:56 snort[1198]: Child exited unexpectedly
          Oct 31 22:46:55 snort[1251]: FATAL ERROR: Failed to Lock PID File "/var/run//snort_rl1.pid" for PID "1251"
          Oct 31 22:46:55 snort[1251]: FATAL ERROR: Failed to Lock PID File "/var/run//snort_rl1.pid" for PID "1251"
          Oct 31 22:46:55 snort[1251]: PID path stat checked out ok, PID path set to /var/run/
          Oct 31 22:46:55 snort[1251]: PID path stat checked out ok, PID path set to /var/run/
          Oct 31 22:46:55 snort[1251]: Var 'rl1_ADDRESS' redefined
          Oct 31 22:46:55 snort[1251]: Var 'rl1_ADDRESS' redefined
          Oct 31 22:46:55 snort[1198]: Initializing daemon mode
          Oct 31 22:46:55 snort[1198]: Initializing daemon mode
          Oct 31 22:46:55 snort[1198]: , value = 24.99.96.0/255.255.252.0
          Oct 31 22:46:55 snort[1198]: , value = 24.99.96.0/255.255.252.0
          Oct 31 22:46:55 snort[1198]: Var 'rl1_ADDRESS' defined, value len = 24 chars
          Oct 31 22:46:55 snort[1198]: Var 'rl1_ADDRESS' defined, value len = 24 chars
          Oct 31 22:46:55 snort[1198]: Warning: flowbits key 'dce.isystemactivator.bind.call.attempt' is set but not ever checked.
          Oct 31 22:46:55 snort[1198]: Warning: flowbits key 'dce.isystemactivator.bind.call.attempt' is set but not ever checked.
          Oct 31 22:46:55 snort[1198]: Warning: flowbits key 'dce.bind.veritas' is set but not ever checked.
          Oct 31 22:46:55 snort[1198]: Warning: flowbits key 'dce.bind.veritas' is set but not ever checked.
          Oct 31 22:46:55 snort[1198]: Warning: flowbits key 'fkwp_conn_suc_cts' is set but not ever checked.
          Oct 31 22:46:55 snort[1198]: Warning: flowbits key 'fkwp_conn_suc_cts' is set but not ever checked.
          Oct 31 22:46:55 snort[1198]: Warning: flowbits key 'odf.file' is set but not ever checked.
          Oct 31 22:46:55 snort[1198]: Warning: flowbits key 'odf.file' is set but not ever checked.
          Oct 31 22:46:55 snort[1198]: Warning: flowbits key 'backdoor.charon.download.log.1' is checked but not ever set.
          Oct 31 22:46:55 snort[1198]: Warning: flowbits key 'backdoor.charon.download.log.1' is checked but not ever set.
          Oct 31 22:46:55 snort[1198]: Warning: flowbits key 'optixlite_fai_conn_cts' is set but not ever checked.
          Oct 31 22:46:55 snort[1198]: Warning: flowbits key 'optixlite_fai_conn_cts' is set but not ever checked.
          Oct 31 22:46:55 snort[1198]: Warning: flowbits key 'ms_sql_seen_dns' is checked but not ever set.
          Oct 31 22:46:55 snort[1198]: Warning: flowbits key 'ms_sql_seen_dns' is checked but not ever set.
          Oct 31 22:46:55 snort[1198]: Log directory = /var/log/snort
          Oct 31 22:46:55 snort[1198]: Log directory = /var/log/snort
          Oct 31 22:46:55 snort[1198]: Rule application order: ->activation->dynamic->pass->drop->alert->log
          Oct 31 22:46:55 snort[1198]: Rule application order: ->activation->dynamic->pass->drop->alert->log
          Oct 31 22:46:55 snort[1198]: –-----------------------------------------------------------------------------
          Oct 31 22:46:55 snort[1198]: –-----------------------------------------------------------------------------
          Oct 31 22:46:55 snort[1198]: | none
          Oct 31 22:46:55 snort[1198]: | none
          Oct 31 22:46:55 snort[1198]: +–---------------------[suppression]–----------------------------------------
          Oct 31 22:46:55 snort[1198]: +–---------------------[suppression]–----------------------------------------
          Oct 31 22:46:55 snort[1198]: | gen-id=1 sig-id=7760 type=Limit tracking=src count=1 seconds=600
          Oct 31 22:46:55 snort[1198]: | gen-id=1 sig-id=7760 type=Limit tracking=src count=1 seconds=600
          Oct 31 22:46:55 snort[1198]: | gen-id=1 sig-id=7531 type=Limit tracking=src count=1 seconds=6000
          Oct 31 22:46:55 snort[1198]: | gen-id=1 sig-id=7531 type=Limit tracking=src count=1 seconds=6000
          Oct 31 22:46:55 snort[1198]: | gen-id=1 sig-id=5829 type=Limit tracking=src count=1 seconds=300
          Oct 31 22:46:55 snort[1198]: | gen-id=1 sig-id=5829 type=Limit tracking=src count=1 seconds=300
          Oct 31 22:46:55 snort[1198]: | gen-id=1 sig-id=5891 type=Limit tracking=src count=1 seconds=300
          Oct 31 22:46:55 snort[1198]: | gen-id=1 sig-id=5891 type=Limit tracking=src count=1 seconds=300
          Oct 31 22:46:55 snort[1198]: | gen-id=1 sig-id=7182 type=Limit tracking=src count=1 seconds=300
          Oct 31 22:46:55 snort[1198]: | gen-id=1 sig-id=7182 type=Limit tracking=src count=1 seconds=300
          Oct 31 22:46:55 snort[1198]: | gen-id=1 sig-id=6290 type=Limit tracking=src count=1 seconds=300
          Oct 31 22:46:55 snort[1198]: | gen-id=1 sig-id=6290 type=Limit tracking=src count=1 seconds=300
          Oct 31 22:46:55 snort[1198]: | gen-id=1 sig-id=5836 type=Limit tracking=src count=1 seconds=600
          Oct 31 22:46:55 snort[1198]: | gen-id=1 sig-id=5836 type=Limit tracking=src count=1 seconds=600
          Oct 31 22:46:55 snort[1198]: | gen-id=1 sig-id=7593 type=Limit tracking=src count=1 seconds=300
          Oct 31 22:46:55 snort[1198]: | gen-id=1 sig-id=7593 type=Limit tracking=src count=1 seconds=300
          Oct 31 22:46:55 snort[1198]: | gen-id=1 sig-id=8464 type=Limit tracking=src count=1 seconds=300
          Oct 31 22:46:55 snort[1198]: | gen-id=1 sig-id=8464 type=Limit tracking=src count=1 seconds=300
          Oct 31 22:46:55 snort[1198]: | gen-id=1 sig-id=8071 type=Limit tracking=src count=1 seconds=300
          Oct 31 22:46:55 snort[1198]: | gen-id=1 sig-id=8071 type=Limit tracking=src count=1 seconds=300
          Oct 31 22:46:55 snort[1198]: | gen-id=1 sig-id=6490 type=Limit tracking=src count=1 seconds=300
          Oct 31 22:46:55 snort[1198]: | gen-id=1 sig-id=6490 type=Limit tracking=src count=1 seconds=300
          Oct 31 22:46:55 snort[1198]: | gen-id=1 sig-id=5824 type=Limit tracking=src count=1 seconds=60
          Oct 31 22:46:55 snort[1198]: | gen-id=1 sig-id=5824 type=Limit tracking=src count=1 seconds=60
          Oct 31 22:46:55 snort[1198]: | gen-id=1 sig-id=5945 type=Limit tracking=src count=1 seconds=300
          Oct 31 22:46:55 snort[1198]: | gen-id=1 sig-id=5945 type=Limit tracking=src count=1 seconds=300
          Oct 31 22:46:55 snort[1198]: | gen-id=1 sig-id=7558 type=Limit tracking=src count=1 seconds=600
          Oct 31 22:46:55 snort[1198]: | gen-id=1 sig-id=7558 type=Limit tracking=src count=1 seconds=600
          Oct 31 22:46:55 snort[1198]: | gen-id=1 sig-id=6232 type=Limit tracking=src count=1 seconds=300
          Oct 31 22:46:55 snort[1198]: | gen-id=1 sig-id=6232 type=Limit tracking=src count=1 seconds=300
          Oct 31 22:46:55 snort[1198]: | gen-id=1 sig-id=6174 type=Limit tracking=src count=1 seconds=300
          Oct 31 22:46:55 snort[1198]: | gen-id=1 sig-id=6174 type=Limit tracking=src count=1 seconds=300
          Oct 31 22:46:55 snort[1198]: | gen-id=1 sig-id=7141 type=Limit tracking=src count=1 seconds=600
          Oct 31 22:46:55 snort[1198]: | gen-id=1 sig-id=7141 type=Limit tracking=src count=1 seconds=600

          1 Reply Last reply Reply Quote 0
          • S
            sullrich
            last edited by Nov 1, 2006, 3:49 AM

            Not enough ram.

            1 Reply Last reply Reply Quote 0
            • Y
              yoda715
              last edited by Nov 1, 2006, 3:51 AM

              I have 512mb, and after clicking 'save' it boots up fine. Far as I can tell no other processes are killed either.

              And this line is incorrect:
              Oct 31 22:47:14    SnortStartup[1307]: Ram free BEFORE starting Snort: 16M – Ram free AFTER starting Snort: 270M -- Mode ac-sparsebands -- Snort memory usage:

              1 Reply Last reply Reply Quote 0
              • S
                sullrich
                last edited by Nov 1, 2006, 3:52 AM

                We recommend 1024 megs.

                http://wiki.pfsense.com/wikka.php?wakka=ReleaseCaveats

                1 Reply Last reply Reply Quote 0
                • Y
                  yoda715
                  last edited by Nov 1, 2006, 3:53 AM

                  Yea I've seen that. I didn't have problems with starting up until 1.0.1. I'll try getting more ram and see if that  solves it.

                  1 Reply Last reply Reply Quote 0
                  • S
                    sullrich
                    last edited by Nov 1, 2006, 3:59 AM

                    Nothing in snort changed in 1.0.1 except for 2 filter rules changes and the startup messages shown in the system log.

                    Hardly anything related to this.

                    1 Reply Last reply Reply Quote 0
                    • Y
                      yoda715
                      last edited by Nov 3, 2006, 11:21 AM Nov 3, 2006, 11:17 AM

                      Upgraded to a new system: P4 2.4ghz, 1GB ram, 300gb HD (with 2gb swap).

                      Snort will not start up upon reboot. I have to click 'Save' under settings each time to get it to boot up.

                      I now have plenty of memory. When Snort does startup properly after clicking save, the total memory usage hovers around 57%. So I know it's not a memory issue now.

                      Also, there is no way this log statement is correct:
                      Nov 3 06:23:35 SnortStartup[1291]: Ram free BEFORE starting Snort: 18M – Ram free AFTER starting Snort: 444M -- Mode ac-sparsebands -- Snort memory usage:

                      1 Reply Last reply Reply Quote 0
                      • S
                        sullrich
                        last edited by Nov 3, 2006, 3:47 PM

                        Uninstall snort and reinstall.

                        1 Reply Last reply Reply Quote 0
                        • Y
                          yoda715
                          last edited by Nov 3, 2006, 7:32 PM

                          That seems to have taken care of it. Did you make any changes?

                          1 Reply Last reply Reply Quote 0
                          • S
                            sullrich
                            last edited by Nov 3, 2006, 8:54 PM

                            You probably installed during the development of the startup notification code.  I'll bump the version this weekend.

                            1 Reply Last reply Reply Quote 0
                            • Y
                              yoda715
                              last edited by Nov 3, 2006, 9:28 PM

                              Grr. I just rebooted again, and it did not start up. I can't seem to find a pattern here.

                              1 Reply Last reply Reply Quote 0
                              • Y
                                yoda715
                                last edited by Nov 4, 2006, 9:32 PM

                                ok. The problem still exists. I've rebooted 5 times. Inbetween each reboot, I waited 10 minutes. During the first 3 minutes on each reboot, Snort would start to initialize. 3-4 minutes after rebooting, snort will exit. Only way to get snort to start is to click 'save' under snort settings. After clicking 'save' and about 3 minutes later, snort completes initialization and I start to receive alerts.

                                Here's the log of when it fails:

                                Nov 4 16:18:18 snort[1003]: Snort exiting
                                Nov 4 16:18:18 snort[1003]: Snort exiting
                                Nov 4 16:18:18 kernel: sis0: promiscuous mode disabled
                                Nov 4 16:18:18 snort[1003]: ===============================================================================
                                Nov 4 16:18:18 snort[1003]: ===============================================================================
                                Nov 4 16:18:18 snort[1003]: PASSED: 0
                                Nov 4 16:18:18 snort[1003]: PASSED: 0
                                Nov 4 16:18:18 snort[1003]: LOGGED: 0
                                Nov 4 16:18:18 snort[1003]: LOGGED: 0
                                Nov 4 16:18:18 snort[1003]: ALERTS: 0
                                Nov 4 16:18:18 snort[1003]: ALERTS: 0
                                Nov 4 16:18:18 snort[1003]: Action Stats:
                                Nov 4 16:18:18 snort[1003]: Action Stats:
                                Nov 4 16:18:18 snort[1003]: ===============================================================================
                                Nov 4 16:18:18 snort[1003]: ===============================================================================
                                Nov 4 16:18:18 snort[1003]: DISCARD: 0 (0.000%)
                                Nov 4 16:18:18 snort[1003]: DISCARD: 0 (0.000%)
                                Nov 4 16:18:18 snort[1003]: OTHER: 0 (0.000%)
                                Nov 4 16:18:18 snort[1003]: OTHER: 0 (0.000%)
                                Nov 4 16:18:18 snort[1003]: FRAG: 0 (0.000%)
                                Nov 4 16:18:18 snort[1003]: FRAG: 0 (0.000%)
                                Nov 4 16:18:18 snort[1003]: IPX: 0 (0.000%)
                                Nov 4 16:18:18 snort[1003]: IPX: 0 (0.000%)
                                Nov 4 16:18:18 snort[1003]: ETHLOOP: 0 (0.000%)
                                Nov 4 16:18:18 snort[1003]: ETHLOOP: 0 (0.000%)
                                Nov 4 16:18:18 snort[1003]: IPv6: 0 (0.000%)
                                Nov 4 16:18:18 snort[1003]: IPv6: 0 (0.000%)
                                Nov 4 16:18:18 snort[1003]: EAPOL: 0 (0.000%)
                                Nov 4 16:18:18 snort[1003]: EAPOL: 0 (0.000%)
                                Nov 4 16:18:18 snort[1003]: ARP: 0 (0.000%)
                                Nov 4 16:18:18 snort[1003]: ARP: 0 (0.000%)
                                Nov 4 16:18:18 snort[1003]: ICMP: 0 (0.000%)
                                Nov 4 16:18:18 snort[1003]: ICMP: 0 (0.000%)
                                Nov 4 16:18:18 snort[1003]: UDP: 0 (0.000%)
                                Nov 4 16:18:18 snort[1003]: UDP: 0 (0.000%)
                                Nov 4 16:18:18 snort[1003]: TCP: 0 (0.000%)
                                Nov 4 16:18:18 snort[1003]: TCP: 0 (0.000%)
                                Nov 4 16:18:18 snort[1003]: Breakdown by protocol:
                                Nov 4 16:18:18 snort[1003]: Breakdown by protocol:
                                Nov 4 16:18:18 snort[1003]: ===============================================================================
                                Nov 4 16:18:18 snort[1003]: ===============================================================================
                                Nov 4 16:18:18 snort[1003]: Outstanding: 709(66.887%)
                                Nov 4 16:18:18 snort[1003]: Outstanding: 709(66.887%)
                                Nov 4 16:18:18 snort[1003]: Dropped: 351(33.113%)
                                Nov 4 16:18:18 snort[1003]: Dropped: 351(33.113%)
                                Nov 4 16:18:18 snort[1003]: Analyzed: 0(0.000%)
                                Nov 4 16:18:18 snort[1003]: Analyzed: 0(0.000%)
                                Nov 4 16:18:18 snort[1003]: Snort received 1060 packets
                                Nov 4 16:18:18 snort[1003]: Snort received 1060 packets
                                Nov 4 16:18:18 snort[1003]: –----------------------------- Nov 4 16:18:18 snort[1003]: –-----------------------------
                                Nov 4 16:18:18 snort[1003]: Recovered Nodes: 0
                                Nov 4 16:18:18 snort[1003]: Recovered Nodes: 0
                                Nov 4 16:18:18 snort[1003]: Nodes: 0
                                Nov 4 16:18:18 snort[1003]: Nodes: 0
                                Nov 4 16:18:18 snort[1003]: Finds: 0 (Sucessful: 0(%0.000000) Unsucessful: 0(%0.000000))
                                Nov 4 16:18:18 snort[1003]: Finds: 0 (Sucessful: 0(%0.000000) Unsucessful: 0(%0.000000))
                                Nov 4 16:18:18 snort[1003]: Memcap: 2097152 Overhead Bytes: 262152
                                Nov 4 16:18:18 snort[1003]: Memcap: 2097152 Overhead Bytes: 262152
                                Nov 4 16:18:18 snort[1003]: ,–---[SERVER STATS]–----------
                                Nov 4 16:18:18 snort[1003]: ,–---[SERVER STATS]–----------
                                Nov 4 16:18:18 snort[1003]: Recovered Nodes: 0
                                Nov 4 16:18:18 snort[1003]: Recovered Nodes: 0
                                Nov 4 16:18:18 snort[1003]: Nodes: 0
                                Nov 4 16:18:18 snort[1003]: Nodes: 0
                                Nov 4 16:18:18 snort[1003]: Finds: 0 (Sucessful: 0(%0.000000) Unsucessful: 0(%0.000000))
                                Nov 4 16:18:18 snort[1003]: Finds: 0 (Sucessful: 0(%0.000000) Unsucessful: 0(%0.000000))
                                Nov 4 16:18:18 snort[1003]: Memcap: 25165824 Overhead Bytes: 4000016
                                Nov 4 16:18:18 snort[1003]: Memcap: 25165824 Overhead Bytes: 4000016
                                Nov 4 16:18:18 snort[1003]: UNIQUE_TRACKER STATS
                                Nov 4 16:18:18 snort[1003]: UNIQUE_TRACKER STATS
                                Nov 4 16:18:18 snort[1003]: Score Entry Size:: 112
                                Nov 4 16:18:18 snort[1003]: Score Entry Size:: 112
                                Nov 4 16:18:18 snort[1003]: Recovered Nodes: 0
                                Nov 4 16:18:18 snort[1003]: Recovered Nodes: 0
                                Nov 4 16:18:18 snort[1003]: Nodes: 0
                                Nov 4 16:18:18 snort[1003]: Nodes: 0
                                Nov 4 16:18:18 snort[1003]: Finds: 0 (Sucessful: 0(%0.000000) Unsucessful: 0(%0.000000))
                                Nov 4 16:18:18 snort[1003]: Finds: 0 (Sucessful: 0(%0.000000) Unsucessful: 0(%0.000000))
                                Nov 4 16:18:18 snort[1003]: Memcap: 6291456 Overhead Bytes: 1000032
                                Nov 4 16:18:18 snort[1003]: Memcap: 6291456 Overhead Bytes: 1000032
                                Nov 4 16:18:18 snort[1003]: SCOREBOARD_STATS: Portscanners
                                Nov 4 16:18:18 snort[1003]: SCOREBOARD_STATS: Portscanners
                                Nov 4 16:18:18 snort[1003]: Score Entry Size:: 112
                                Nov 4 16:18:18 snort[1003]: Score Entry Size:: 112
                                Nov 4 16:18:18 snort[1003]: Recovered Nodes: 0
                                Nov 4 16:18:18 snort[1003]: Recovered Nodes: 0
                                Nov 4 16:18:18 snort[1003]: Nodes: 0
                                Nov 4 16:18:18 snort[1003]: Nodes: 0
                                Nov 4 16:18:18 snort[1003]: Finds: 0 (Sucessful: 0(%0.000000) Unsucessful: 0(%0.000000))
                                Nov 4 16:18:18 snort[1003]: Finds: 0 (Sucessful: 0(%0.000000) Unsucessful: 0(%0.000000))
                                Nov 4 16:18:18 snort[1003]: Memcap: 25165824 Overhead Bytes: 120048
                                Nov 4 16:18:18 snort[1003]: Memcap: 25165824 Overhead Bytes: 120048
                                Nov 4 16:18:18 snort[1003]: SCOREBOARD_STATS: Active Talkers
                                Nov 4 16:18:18 snort[1003]: SCOREBOARD_STATS: Active Talkers
                                Nov 4 16:18:18 snort[1003]: +–-[ Flow-portscan Stats ]–--------------+
                                Nov 4 16:18:18 snort[1003]: +–-[ Flow-portscan Stats ]–--------------+
                                Nov 4 16:18:18 snort[1003]: finds: 0 reversed: 0(%0.000000) find_success: 0 find_fail: 0 percent_success: (%0.000000) new_flows: 0
                                Nov 4 16:18:18 snort[1003]: finds: 0 reversed: 0(%0.000000) find_success: 0 find_fail: 0 percent_success: (%0.000000) new_flows: 0
                                Nov 4 16:18:18 snort[1003]: IPV4 count: 0 frees: 0 low_time: 0, high_time: 0, diff: 0h:00:00s
                                Nov 4 16:18:18 snort[1003]: IPV4 count: 0 frees: 0 low_time: 0, high_time: 0, diff: 0h:00:00s
                                Nov 4 16:18:18 snort[1003]: Memcap: 10485760 Overhead Bytes 16400 used(%0.156403)/blocks (16400/1) Overhead blocks: 1 Could Hold: (0)
                                Nov 4 16:18:18 snort[1003]: Memcap: 10485760 Overhead Bytes 16400 used(%0.156403)/blocks (16400/1) Overhead blocks: 1 Could Hold: (0)
                                Nov 4 16:18:18 snort[1003]: ,–--[ FLOWCACHE STATS ]–--------
                                Nov 4 16:18:18 snort[1003]: ,–--[ FLOWCACHE STATS ]–--------
                                Nov 4 16:18:18 snort[1003]: Final Flow Statistics
                                Nov 4 16:18:18 snort[1003]: Final Flow Statistics
                                Nov 4 16:18:18 snort[1003]: *** Caught Term-Signal
                                Nov 4 16:18:18 snort[1003]: *** Caught Term-Signal
                                Nov 4 16:18:18 snort[1003]: Not Using PCAP_FRAMES
                                Nov 4 16:18:18 snort[1003]: Not Using PCAP_FRAMES
                                Nov 4 16:18:18 snort[1003]: Snort initialization completed successfully (pid=1003)
                                Nov 4 16:18:18 snort[1003]: Snort initialization completed successfully (pid=1003)
                                Nov 4 16:18:11 check_reload_status: updating dyndns
                                Nov 4 16:18:11 php: : [SNORT] Snort_dynamic_ip_reload.php is starting.
                                Nov 4 16:17:11 SnortStartup[1292]: Ram free BEFORE starting Snort: 18M – Ram free AFTER starting Snort: 702M -- Mode ac-sparsebands -- Snort memory usage:
                                Nov 4 16:16:54 snort2c[1253]: snort2c running in daemon mode pid: 1253
                                Nov 4 16:16:54 snort2c[1253]: snort2c running in daemon mode pid: 1253
                                Nov 4 16:16:54 snort[1092]: Daemon parent exiting
                                Nov 4 16:16:54 snort[1092]: Daemon parent exiting
                                Nov 4 16:16:52 snort[1092]: Child exited unexpectedly
                                Nov 4 16:16:52 snort[1092]: Child exited unexpectedly
                                Nov 4 16:16:51 snort[1242]: FATAL ERROR: Failed to Lock PID File "/var/run//snort_sis0.pid" for PID "1242"
                                Nov 4 16:16:51 snort[1242]: FATAL ERROR: Failed to Lock PID File "/var/run//snort_sis0.pid" for PID "1242"
                                Nov 4 16:16:51 snort[1242]: PID path stat checked out ok, PID path set to /var/run/
                                Nov 4 16:16:51 snort[1242]: PID path stat checked out ok, PID path set to /var/run/
                                Nov 4 16:16:51 snort[1242]: Var 'sis0_ADDRESS' redefined
                                Nov 4 16:16:51 snort[1242]: Var 'sis0_ADDRESS' redefined

                                1 Reply Last reply Reply Quote 0
                                • B
                                  billm
                                  last edited by Nov 5, 2006, 3:07 PM

                                  No wisdom to add here, but wtf?!?!?!?

                                  Nov 4 16:17:11    SnortStartup[1292]: Ram free BEFORE starting Snort: 18M – Ram free AFTER starting Snort: 702M -- Mode ac-sparsebands -- Snort memory usage:

                                  --Bill

                                  pfSense core developer
                                  blog - http://www.ucsecurity.com/
                                  twitter - billmarquette

                                  1 Reply Last reply Reply Quote 0
                                  • Y
                                    yoda715
                                    last edited by Nov 5, 2006, 8:31 PM

                                    I see the same problem.

                                    1 Reply Last reply Reply Quote 0
                                    • Y
                                      yoda715
                                      last edited by Nov 7, 2006, 7:22 AM

                                      I am also seeing snort randomly restart itself. It seems to happen in the middle of the night. Anyone seeing this in their logs?

                                      1 Reply Last reply Reply Quote 0
                                      • S
                                        sullrich
                                        last edited by Nov 7, 2006, 8:24 PM

                                        DHCP?  It restarts after renewing the lease.  Normal.

                                        1 Reply Last reply Reply Quote 0
                                        • Y
                                          yoda715
                                          last edited by Nov 8, 2006, 5:16 AM

                                          Ok. That would explain random restarts. However, sometimes when it restarts at night it does not fully initialize and will terminate. I have to click save to start it up again.

                                          1 Reply Last reply Reply Quote 0
                                          20 out of 100
                                          • First post
                                            20/100
                                            Last post
                                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.
                                            This community forum collects and processes your personal information.
                                            consent.not_received