Snort not Starting - 2.0 RC3 amd64

cwagz

I am currently running the 6/21 evening build of 2.0 RC3.

I am unable to get Snort to start. I see a topic on this in the packages area but no one seems to have an answer. Is this something that needs to be fixed in pfSense or is it a problem with the package itself? It was working fine in the builds from a few weeks ago.

louis-m

i get this on an upgrade all the time.
i simply delete the snort interface and then recreate it, download the signatures, select the rules and it then starts.

dwood

On a clean amd64 RC3 install and clean snort install…no go. Wondering if a mod can chime here with the correct process to drive a fix?

This post: http://forum.pfsense.org/index.php/topic,37557.0.html is approaching 700 reads which might suggest a universal problem. Is snort working for you on RC3?

psgandalf

I upgraded to built on Mon Jun 27 06:38:49 EDT 2011 on my Alix board.
Before I deleted the interface and reset snort. After the upgrade Snort
started but I wasn't able to choose any rules even thoug the update went
well. But after stopping the interface and restarting it the rules where ther
to choose from. Back in business :D

dwood

Two questions.

1. By "deleted" interface, you mean you disabled it in the GUI? Also, which interface are we talking about? If you're installed packages via the GUI, not sure how to delete for example the WAN interface and still install the package.
2. By "reset snort" are we talking just removing the package via the GUI with the SNORT "Save settings" checkbox unchecked?

I've done at least a dozen clean installs of RC3 over the last week on 2 new boxes (testing other packages, load balancing, traffic shaping etc.) and SNORT has never run succesfully…although my OINK code etc. works fine, rules update and I can select them etc. Sorry for the questions..call me a newbie :-)

cwagz

@psgandalf:

I upgraded to built on Mon Jun 27 06:38:49 EDT 2011 on my Alix board.
Before I deleted the interface and reset snort. After the upgrade Snort
started but I wasn't able to choose any rules even thoug the update went
well. But after stopping the interface and restarting it the rules where ther
to choose from. Back in business :D

I still cannot get Snort to start with 2.0-RC3 (amd64) built on Tue Jun 28 07:22:21 EDT 2011. I just re-installed to see if it would work.

psgandalf

Answer to the questions:
All under services/snort
1. Under Snort Interfaces I deleted my interface.
2. Under Global settings there is a Reset button. I used that one…

@dwood:

Two questions.

1. By "deleted" interface, you mean you disabled it in the GUI? Also, which interface are we talking about? If you're installed packages via the GUI, not sure how to delete for example the WAN interface and still install the package.
2. By "reset snort" are we talking just removing the package via the GUI with the SNORT "Save settings" checkbox unchecked?

I've done at least a dozen clean installs of RC3 over the last week on 2 new boxes (testing other packages, load balancing, traffic shaping etc.) and SNORT has never run succesfully…although my OINK code etc. works fine, rules update and I can select them etc. Sorry for the questions..call me a newbie :-)

dwood

Thanks for the clarification. Just a guess here, but I'm guessing you had snort installed somewhere before June3rd or so.

Going through that process on a new install of RC3, and repeating your process:

Jun 30 09:05:57 SnortStartup[36413]: Snort HARD Reload For 45292_re1…
Jun 30 09:05:57 SnortStartup[33404]: Snort Startup files Sync…

So with SNORT loaded, reset, interface reset, pfsense updated to latest snapshot, rules downloaded again, updated, and a few rules selected to filter...no go. Based on the removal of the 32 bit snort package, I'd guess there are known issues with the 64bit version too that are not being shared here.

Cheers,
D.