Snort Won't Start After Upgrade

rudfinch · Jun 11, 2011, 3:04 AM

I looked into snort.inc, looks like snort supposed to fetch perl-threaded-5.12.1_1.tbz as dependency… but couldn't find anywhere... the link to the file seems broken... I don't know if this is the cause of alert_pf error... hope this will be fixed soon. :)

asterix · Jun 12, 2011, 5:04 AM

Can anyone fix the Snort install package?

dzeanah · Jun 14, 2011, 3:05 PM

It's possible the maintainer is on vacation. I sent him a pm a while back and have not yet received a response.

asterix · Jun 14, 2011, 2:07 AM

Any updates on the Snort package fix?

th3r3isnospoon · Jun 14, 2011, 2:57 AM

I haven't heard or seen anything yet :-\

Hopefully soon….

-th3r3isnospoon

asterix · Jun 16, 2011, 12:46 AM

Over a week since the package is in broken state >:(

Has no one installed snort since last 7 days?

th3r3isnospoon · Jun 16, 2011, 8:16 PM

@asterix:

Over a week since the package is in broken state >:(

Has no one installed snort since last 7 days?

Apparently not….Hope this is fixed soon...

-th3r3isnospoon

asterix · Jun 18, 2011, 5:37 PM

Down with Snort since past 10 days !! >:(

CyCyb3rradberRad · Jun 21, 2011, 12:16 AM

I am having the same problem and it appears this person might have the same issue as well.
http://forum.pfsense.org/index.php/topic,37952.0.html

I feel so naked without my Snort. ;D

pfSense 2.0 RC2 build date June 15th
Snort 2.8.6.1 pkg 1.34

Also one more thing to add. According to the pfSense_Snort Twitter account it looks like he is planning a release pretty soon of Snort 2.9.0.4 pkg 1.37. Hopefully that has a fix for the issue we are seeing.

berglundma · Jun 21, 2011, 1:25 AM

I too am having the same issue. Based on the number of reads I'm thinking we're not alone.

dwood · Jun 22, 2011, 7:26 PM

Same thing here on a new install:

Version:
2.0-RC3 (amd64)
built on Tue Jun 21 23:37:22 EDT 2011

Intel(R) Atom(TM) CPU 330 @ 1.60GHz
Current: 799 MHz, Max: 1599 MHz

When starting Snort:
snort[26473]: FATAL ERROR: /usr/local/etc/snort/snort_31943_re1/snort.conf(351) Unknown output plugin: "alert_pf"

Cheers,
D.

asterix · Jun 23, 2011, 12:10 AM

The Snort package is broken since over 2 weeks now. First I thought it was a snapshot issue but after trying multiple snapshots, I confirmed it's a snort package issue.

dwood · Jun 23, 2011, 6:15 AM

With a clean RC3 install, the error message is now different than with RC2

Clean RC2 install:
snort[26473]: FATAL ERROR: /usr/local/etc/snort/snort_31943_re1/snort.conf(351) Unknown output plugin: "alert_pf"

Clean RC3 install:
Jun 23 01:50:39 SnortStartup[5379]: Snort HARD Reload For 22075_re1…
Jun 23 01:50:38 SnortStartup[1825]: Snort Startup files Sync…

Is there a method to "manually" install a newer version of snort without using the package? Looking at various dates on the "JamesDean" twitter feeds, the last update was on Mar 16, indicating 2.9.0.4 was due in a few days. This being June, safe bet that "jamesdean" is otherwise occupied…so would love to figure out a fix that doesn't use the package if that is at all possible.

Btw, I've been posting my adventures (including a hardware list and various notes) with pfSense over at smallnetbuilder: http://forums.smallnetbuilder.com/showthread.php?t=5379

asterix · Jun 27, 2011, 4:40 PM

Any progress on this issue resolution?

psgandalf · Jun 28, 2011, 8:20 PM

I upgraded to built on Mon Jun 27 06:38:49 EDT 2011 on my Alix board.
Before I deleted the interface and reset snort. After the upgrade Snort
started but I wasn't able to choose any rules even thoug the update went
well. But after stopping the interface and restarting it the rules where ther
to choose from. Back in business ;D

asterix · Jun 29, 2011, 4:00 PM

Tried that. Doesn't work for me.

jamesdean · Jun 30, 2011, 6:29 AM

I am updating snort-dev binaries, I have to remove snort from pfsense packages 2.0 x86 for a day or two. Its broken anyway.

The new GUI is done, Im on the last strep, that is setting up pfSense ports to build binaries automatically.

dwood · Jun 30, 2011, 9:43 PM

Thanks for the update. I'd guess AMD64 is next?

I know the time committment required to do the work you're doing. I'm sure I speak for literally 1000s when I say thanks for your efforts :-) I'm a recent pfsense convert and despite the current bugs, still loving it.

Cheers,
Dennis.

_igor_ · Jul 2, 2011, 10:26 AM

Thanks, jamesdean, that sounds great! Take your time to fix your issues. Great job you do with this great package!

sporkpdx · Jul 5, 2011, 2:40 AM

I am also running into this.

I have managed to copy a working package over from a pfsense 1.2.3 install for the timebeing but I'm hoping this gets fixed for 2.0 x64 asap, I'll owe ya a beer. :)