Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Snort Won't Start After Upgrade

    Scheduled Pinned Locked Moved pfSense Packages
    301 Posts 64 Posters 219.7k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • T
      th3r3isnospoon
      last edited by

      At the bottom of this website, they talk about the same issues: http://michaelok.tumblr.com/

      I'll read through it and possibly try some fixes and post back :)

      -th3r3isnospoon

      1 Reply Last reply Reply Quote 0
      • R
        rudfinch
        last edited by

        Hello all–

        I have same error after upgrade to 7-june and 8-june pfsense2-RC2 amd64 full.

        after I ln -s /lib/libpcap.so.7 to /usr/local/lib/libpcap.so.1
        and try running snort on the web-configurator I got unsupported output plugin: "alert_pf" error on my syslog...

        @th3r3isnospoon:
        ERROR: parser.c(5165) Could not stat dynamic module path "/usr/local/lib/snort_dynamicpreprocessor/": No such file or directory.
        is dynamic lib path error.. the path in pfsense is "/usr/local/lib/snort/dynamicpreprocessor/"

        1 Reply Last reply Reply Quote 0
        • T
          th3r3isnospoon
          last edited by

          FWIW, I submitted a bug report.

          http://redmine.pfsense.org/issues/1590

          -th3r3isnospoon

          1 Reply Last reply Reply Quote 0
          • A
            akm22562
            last edited by

            Hi all,

            I have the exact same console output.  The interesting thing is syslog.

            In the latest release of pfsense 2.0-RC2 I can't get Snort to start.  The syslog reveals the following:

            Jun 9 07:12:19 SnortStartup[63658]: Snort HARD Reload For 34679_sis0…
            Jun 9 07:12:19 snort[56907]: FATAL ERROR: /usr/local/etc/snort/snort_34679_sis0/snort.conf(207) Unknown output plugin: "alert_pf"
            Jun 9 07:12:19 snort[56907]: FATAL ERROR: /usr/local/etc/snort/snort_34679_sis0/snort.conf(207) Unknown output plugin: "alert_pf"

            Line 207 of the above file is:

            output alert_pf: /usr/local/etc/snort/whitelist/defaultwlist,snort2c

            Andrew

            1 Reply Last reply Reply Quote 0
            • A
              asterix
              last edited by

              no go.

              Are we the only ones facing this issue? Can anyone else confirm the same with a clean install of pfsense and snort package?

              1 Reply Last reply Reply Quote 0
              • O
                oztiks
                last edited by

                @asterix:

                no go.

                Are we the only ones facing this issue? Can anyone else confirm the same with a clean install of pfsense and snort package?

                Mine had some clean installs and I did have the issue; which I resolved with my ln fix. I'm not sure why it's not working for others. :(

                1 Reply Last reply Reply Quote 0
                • A
                  asterix
                  last edited by

                  Latest few snapshots even dynamic DNS is failing and IP shows in red as 0.0.0.0

                  Looks like both a snapshot and Snort package issue.

                  1 Reply Last reply Reply Quote 0
                  • R
                    rudfinch
                    last edited by

                    I looked into snort.inc, looks like snort supposed to fetch perl-threaded-5.12.1_1.tbz as dependency… but couldn't find anywhere... the link to the file seems broken... I don't know if this is the cause of alert_pf error... hope this will be fixed soon. :)

                    1 Reply Last reply Reply Quote 0
                    • A
                      asterix
                      last edited by

                      Can anyone fix the Snort install package?

                      1 Reply Last reply Reply Quote 0
                      • D
                        dzeanah
                        last edited by

                        It's possible the maintainer is on vacation.  I sent him a pm a while back and have not yet received a response.

                        1 Reply Last reply Reply Quote 0
                        • A
                          asterix
                          last edited by

                          Any updates on the Snort package fix?

                          1 Reply Last reply Reply Quote 0
                          • T
                            th3r3isnospoon
                            last edited by

                            I haven't heard or seen anything yet  :-\

                            Hopefully soon….

                            -th3r3isnospoon

                            1 Reply Last reply Reply Quote 0
                            • A
                              asterix
                              last edited by

                              Over a week since the package is in broken state  >:(

                              Has no one installed snort since last 7 days?

                              1 Reply Last reply Reply Quote 0
                              • T
                                th3r3isnospoon
                                last edited by

                                @asterix:

                                Over a week since the package is in broken state  >:(

                                Has no one installed snort since last 7 days?

                                Apparently not….Hope this is fixed soon...

                                -th3r3isnospoon

                                1 Reply Last reply Reply Quote 0
                                • A
                                  asterix
                                  last edited by

                                  Down with Snort since past 10 days !!  >:(

                                  1 Reply Last reply Reply Quote 0
                                  • C
                                    CyCyb3rradberRad
                                    last edited by

                                    I am having the same problem and it appears this person might have the same issue as well.
                                    http://forum.pfsense.org/index.php/topic,37952.0.html

                                    I feel so naked without my Snort.  ;D

                                    pfSense 2.0 RC2 build date June 15th
                                    Snort 2.8.6.1 pkg 1.34

                                    Also one more thing to add.  According to the pfSense_Snort Twitter account it looks like he is planning a release pretty soon of Snort 2.9.0.4 pkg 1.37.  Hopefully that has a fix for the issue we are seeing.

                                    1 Reply Last reply Reply Quote 0
                                    • B
                                      berglundma
                                      last edited by

                                      I too am having the same issue. Based on the number of reads I'm thinking we're not alone.

                                      1 Reply Last reply Reply Quote 0
                                      • D
                                        dwood
                                        last edited by

                                        Same thing here on a new install:

                                        Version:
                                        2.0-RC3 (amd64)
                                        built on Tue Jun 21 23:37:22 EDT 2011

                                        Intel(R) Atom(TM) CPU 330 @ 1.60GHz
                                        Current: 799 MHz, Max: 1599 MHz

                                        When starting Snort:
                                        snort[26473]: FATAL ERROR: /usr/local/etc/snort/snort_31943_re1/snort.conf(351) Unknown output plugin: "alert_pf"

                                        Cheers,
                                        D.

                                        1 Reply Last reply Reply Quote 0
                                        • A
                                          asterix
                                          last edited by

                                          The Snort package is broken since over 2 weeks now. First I thought it was a snapshot issue but after trying multiple snapshots, I confirmed it's a snort package issue.

                                          1 Reply Last reply Reply Quote 0
                                          • D
                                            dwood
                                            last edited by

                                            With a clean RC3 install, the error message is now different than with RC2

                                            Clean RC2 install:
                                            snort[26473]: FATAL ERROR: /usr/local/etc/snort/snort_31943_re1/snort.conf(351) Unknown output plugin: "alert_pf"

                                            Clean RC3 install:
                                            Jun 23 01:50:39 SnortStartup[5379]: Snort HARD Reload For 22075_re1…
                                            Jun 23 01:50:38 SnortStartup[1825]: Snort Startup files Sync…

                                            Is there a method to "manually" install a newer version of snort without using the package?  Looking at various dates on the "JamesDean" twitter feeds, the last update was on Mar 16, indicating 2.9.0.4 was due in a few days.  This being June, safe bet that "jamesdean" is otherwise occupied…so would love to figure out a fix that doesn't use the package if that is at all possible.

                                            Btw, I've been posting my adventures (including a hardware list and various notes) with pfSense over at smallnetbuilder:  http://forums.smallnetbuilder.com/showthread.php?t=5379

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.