Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Snort Problems Snap 1-3-2011

    Scheduled Pinned Locked Moved 2.0-RC Snapshot Feedback and Problems - RETIRED
    16 Posts 5 Posters 4.4k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • JSmoradaJ Offline
      JSmorada
      last edited by

      I just installed the latest snapshot and the content encoding error persists. Also, the Snort package won't start. The system log shows:

      Jan 5 09:20:29 SnortStartup[29475]: Snort HARD Reload For 58373_fxp1…
      Jan 5 09:20:29 snort[24719]: FATAL ERROR: Unable to open rules file "/usr/local/etc/snort/snort_58373_fxp1//usr/local/etc/snort/snort_58373_fxp1/rules/snort_attack-responses.rules": No such file or directory.
      Jan 5 09:20:29 snort[24719]: FATAL ERROR: Unable to open rules file "/usr/local/etc/snort/snort_58373_fxp1//usr/local/etc/snort/snort_58373_fxp1/rules/snort_attack-responses.rules": No such file or directory.

      Is anyone even working on this issue?

      1 Reply Last reply Reply Quote 0
      • V Offline
        vito
        last edited by

        @nipstech:

        I just installed the latest snapshot and the content encoding error persists. Also, the Snort package won't start. The system log shows:

        Jan 5 09:20:29 SnortStartup[29475]: Snort HARD Reload For 58373_fxp1…
        Jan 5 09:20:29 snort[24719]: FATAL ERROR: Unable to open rules file "/usr/local/etc/snort/snort_58373_fxp1//usr/local/etc/snort/snort_58373_fxp1/rules/snort_attack-responses.rules": No such file or directory.
        Jan 5 09:20:29 snort[24719]: FATAL ERROR: Unable to open rules file "/usr/local/etc/snort/snort_58373_fxp1//usr/local/etc/snort/snort_58373_fxp1/rules/snort_attack-responses.rules": No such file or directory.

        Is anyone even working on this issue?

        Those errors most of the time indicate your rules need to be downloaded.
        Try to force a rules update.
        On a different note, with the latest snap can you see the gui?

        1 Reply Last reply Reply Quote 0
        • JSmoradaJ Offline
          JSmorada
          last edited by

          I'm using the latest snapshot and the gui shows an "encoding error" (different issue) so I can't even get to the update tab to force an update.

          1 Reply Last reply Reply Quote 0
          • V Offline
            vito
            last edited by

            @nipstech:

            I'm using the latest snapshot and the gui shows an "encoding error" (different issue) so I can't even get to the update tab to force an update.

            this thread was started for the gui not showing up in the latest snaps….  ;)
            When the issue is resolved, try the update. It seems after a snort package update the rules need to be re-downloaded. Some rules may have been changed/removed and you need to adjust your settings.
            If this is not the case, i recommend starting a new thread. (again, when you can see the gui) :)

            1 Reply Last reply Reply Quote 0
            • W Offline
              Wolfsokin
              last edited by

              as a temporary work around until this is fixed, I opened my config.xml and in the menu section I changed the url for snort from snort_interfaces.php to snort_alerts.php and rebooted. snort_interfaces.php is the only file that this seems to be effecting. Once you actually get into the snort pages, all links work except snort_interfaces.php

              1 Reply Last reply Reply Quote 0
              • JSmoradaJ Offline
                JSmorada
                last edited by

                It worked, thanks!

                Hopefully the issue will be fixed soon…Jon

                1 Reply Last reply Reply Quote 0
                • L Offline
                  louis-m
                  last edited by

                  confirmed but it's a problem if you can't get into the interfaces to set one up.

                  1 Reply Last reply Reply Quote 0
                  • JSmoradaJ Offline
                    JSmorada
                    last edited by

                    True…At least the rules can update. I installed the short dashboard widget and I'm not seeing any alerts though, so I assume that none of them are enabled.

                    1 Reply Last reply Reply Quote 0
                    • W Offline
                      Wolfsokin
                      last edited by

                      @louis-m:

                      confirmed but it's a problem if you can't get into the interfaces to set one up.

                      If you don't already have an interface set up or don't have a backup to restore one from, you can use the snort_interfaces_edit.php page to add one.

                      1 Reply Last reply Reply Quote 0
                      • JSmoradaJ Offline
                        JSmorada
                        last edited by

                        I just looked at the syslog and snort is working. The dashboard widget is what isn't working.

                        1 Reply Last reply Reply Quote 0
                        • JSmoradaJ Offline
                          JSmorada
                          last edited by

                          I can edit the interface settings now but still cannot access the interface tab; getting the same content encoding error. It's been about a week since this problem started but it seems like forever and every time I update to a new snapshot I have to spend a lot of time making sure everything is working… getting old but actually worth the time. The price you pay when using a beta version :'(

                          1 Reply Last reply Reply Quote 0
                          • W Offline
                            Wolfsokin
                            last edited by

                            The second snap for today (Mon Jan 10 13:14:45 EST 2011) allows me to see snort_interfaces.php again and all seems to be working as it should.

                            1 Reply Last reply Reply Quote 0
                            • First post
                              Last post
                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.