Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Snort Won't Start After Upgrade

    pfSense Packages
    64
    301
    212.5k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • H
      hmishra
      last edited by

      I am having the same issue now of not seeing Snort menu entry under Services, even after successful install. I have uninstalled and installed the Snort package a couple times already as per the earlier suggestion.

      I see the following error messages on system log which I thought were relevant:

      Aug 3 17:28:50 SnortStartup[36465]: Snort HARD Reload For 21540_em0_vlan10…
      Aug 3 17:28:50 snort[36189]: FATAL ERROR: Unable to open rules file "/usr/local/etc/snort/snort_21540_em0_vlan10//usr/local/etc/snort/snort_21540_em0_vlan10/rules/emerging-botcc.rules": No such file or directory.
      Aug 3 17:28:50 snort[36189]: FATAL ERROR: Unable to open rules file "/usr/local/etc/snort/snort_21540_em0_vlan10//usr/local/etc/snort/snort_21540_em0_vlan10/rules/emerging-botcc.rules": No such file or directory.

      Now even if there were some issues with the category 'emerging-botcc.rules', I cannot uncheck those now since I cannot bring up Snort setting to uncheck those.

      1 Reply Last reply Reply Quote 0
      • M
        mschiek01
        last edited by

        @ermal:

        mschiek01: Remove the package and install it again.
        Do not use the reinstall features but really delete and install the pacakge.

        That will fix your issue and it should not happen again after that.

        That fixed the issue.

        Thanks again for addressing this quickly.

        1 Reply Last reply Reply Quote 0
        • H
          hmishra
          last edited by

          Ok, Snort is running now. I had to export the config xml and edit out the rule categories which were generating exceptions on system log as stated before. Once I restored it, Snort is now running although I still feel that Snort should not die if choosing what it considers as a invalid category.

          Anyway, now I have a different issue which I am not sure if it is Snort install related since I also updated to the latest snapshot. Now, I can install Squid or Squidguard or Cron individually, but if I install more than one, the other gets bumped off of the services list. Even the menu entry for the previous package is lost. In other words, only one service can be active at a time from among installable packages. This is just a rough observation since I haven't tried all different combinations of packages.

          1 Reply Last reply Reply Quote 0
          • C
            Cino
            last edited by

            @ermal:

            That is IDS integration which might need some people to help out in funding to make properly usable.

            What IDS integration are you talking about?

            So far so good! Whitelist looks to be working. I notice the format of the file has change. Suppress file seems to load without errors, have not tested yet. thank you again!

            1 Reply Last reply Reply Quote 0
            • C
              Cino
              last edited by

              @hmishra:

              Ok, Snort is running now. I had to export the config xml and edit out the rule categories which were generating exceptions on system log as stated before. Once I restored it, Snort is now running although I still feel that Snort should not die if choosing what it considers as a invalid category.

              Anyway, now I have a different issue which I am not sure if it is Snort install related since I also updated to the latest snapshot. Now, I can install Squid or Squidguard or Cron individually, but if I install more than one, the other gets bumped off of the services list. Even the menu entry for the previous package is lost. In other words, only one service can be active at a time from among installable packages. This is just a rough observation since I haven't tried all different combinations of packages.

              how long since you updated? try it again since it seems to be fix for me

              1 Reply Last reply Reply Quote 0
              • H
                hmishra
                last edited by

                Just tried it, still no joy. Having installed Snort first, I tried to install Cron and that bumped off the Snort menu entry under Services.

                1 Reply Last reply Reply Quote 0
                • E
                  eri--
                  last edited by

                  You need to update to latest snapshot to fix the issues with the menu.

                  @Cino,

                  IDS integration is the Block offenders option

                  1 Reply Last reply Reply Quote 0
                  • C
                    Cino
                    last edited by

                    @Ermal The suppress list is working. Snort stayed up last night. Need to do some more testing but block ip's didn't clear after the set time i selected. My time is set to block for 1 hour, I had IPs in there that were blocked 8 hours ago.

                    Edit: I did some more testing and its not removing IPs from the Block list. I looked to see if there was an cron job but there wasn't. Some reason I thinking there was a cron job that was based on the 'Remove blocked hosts every' field

                    1 Reply Last reply Reply Quote 0
                    • M
                      mdovey
                      last edited by

                      The "add another entry" button under the "Add your own custom ips" for Whitelists doesn't appear to be working. So I can only add 1 ip to a whitelist!

                      I've tried under Opera 11.50 and IE9

                      Matthew

                      1 Reply Last reply Reply Quote 0
                      • C
                        Cino
                        last edited by

                        @mdovey:

                        The "add another entry" button under the "Add your own custom ips" for Whitelists doesn't appear to be working. So I can only add 1 ip to a whitelist!

                        I've tried under Opera 11.50 and IE9

                        Matthew

                        This is new, i can confirm that its doing the same thing for me using FF 5… Strange it wasn't doing this last night... I did notice last night that any IPs i did add, wouldn't show up under 'Values' in the 'Services:Snort:Whitelist' tab

                        When i try to add an IP, this is the link the button is pointing too: https://192.168.0.1:445/snort/snort_interfaces_whitelist_edit.php?id=1#

                        1 Reply Last reply Reply Quote 0
                        • E
                          eri--
                          last edited by

                          Fixed even the row helper.

                          The expire of the hosts from the table should be done by a cron job.
                          Please try with the latest package and give a save under Global Settings fro that.

                          1 Reply Last reply Reply Quote 0
                          • C
                            Cino
                            last edited by

                            @ermal:

                            Fixed even the row helper.

                            The expire of the hosts from the table should be done by a cron job.
                            Please try with the latest package and give a save under Global Settings fro that.

                            Adding IPs work again. I still dont see added the IPs under the main page in the values field. I'm thinking there is a limit of 10 entries because it doesn't display pass 10 entries. No biggie for me since it is adding them to the file correctly..

                            the cron job is back and its working for 1hr :-)

                            Thank you again for all your help Emarl!

                            PS I dont have Barnyard2 so I can't test but I think we have tested everything within the package… I still have to create another interface and see how that reacts with snort being bind to 2+ interfaces

                            1 Reply Last reply Reply Quote 0
                            • H
                              hansmuff
                              last edited by

                              I have pfsense 2.0 RC3 64-bit installed. I un-installed Snort when it broke and just re-installed from the packages menu. Does that give me the latest release, because I have the same problem I've been having when Snort initially stopped working.

                              My Snort version is 2.8.6.1 pkg v. 2.0

                              The error in the syslog is "Aug 4 17:27:07 SnortStartup[17989]: Snort HARD Reload For 25369_fxp0…
                              Aug 4 17:27:07 snort[17310]: FATAL ERROR: /usr/local/etc/snort/snort_25369_fxp0/snort.conf(316) Unknown output plugin: "alert_pf""

                              My apologies if I'm doing this wrong.

                              1 Reply Last reply Reply Quote 0
                              • A
                                asterix
                                last edited by

                                Latest amd64 snapshot. Clean install.

                                Snort not starting.

                                Aug 4 18:43:49 SnortStartup[10250]: Snort HARD Reload For 35360_em0…
                                Aug 4 18:43:49 SnortStartup[6313]: Snort Startup files Sync…
                                Aug 4 18:43:22 SnortStartup[47731]: Snort HARD Reload For 35360_em0…
                                Aug 4 18:43:21 SnortStartup[43782]: Snort Startup files Sync…

                                Did a uninstall/install of Snort (not re-install) thrice... no-go

                                Aug 4 18:53:13 SnortStartup[2775]: Snort HARD Reload For 33845_em0…
                                Aug 4 18:53:13 SnortStartup[62907]: Snort Startup files Sync…
                                Aug 4 18:52:54 SnortStartup[33560]: Interface Rule START for 0_33845_em0…
                                Aug 4 18:52:53 SnortStartup[21740]: Toggle for 33845_em0…
                                Aug 4 18:52:47 check_reload_status: Syncing firewall
                                Aug 4 18:52:32 check_reload_status: Syncing firewall
                                Aug 4 18:52:10 SnortStartup[23637]: Snort HARD Reload For 35360_em0…
                                Aug 4 18:52:10 SnortStartup[20060]: Snort Startup files Sync…
                                Aug 4 18:51:29 check_reload_status: Syncing firewall
                                Aug 4 18:50:47 check_reload_status: Syncing firewall
                                Aug 4 18:50:47 check_reload_status: Reloading filter
                                Aug 4 18:50:46 check_reload_status: Syncing firewall
                                Aug 4 18:50:09 check_reload_status: Syncing firewall
                                Aug 4 18:50:08 php: /pkg_mgr_install.php: Beginning package installation for snort.

                                1 Reply Last reply Reply Quote 0
                                • C
                                  Cino
                                  last edited by

                                  @hansmuff and asterix I dont run amd64 on my box, all my testing has been on the i386 platform.

                                  @ermal logged into my console and i noticed some startup errors.
                                  this is right after starting package snort….

                                  chown: /tmp/snort*: No such file or directory
                                  chmod: /var/run/snort*: No such file or directory
                                  chmod: /tmp/snort*: No such file or directory

                                  1 Reply Last reply Reply Quote 0
                                  • G
                                    grandrivers
                                    last edited by

                                    I did a clean install and am having trouble with the emerging threats rules can't get them to show up

                                    pfsense 2.4 super micro A1SRM-2558F
                                    C2558 8gig ECC  60gig SSD
                                    tripple Wan dual pppoe

                                    1 Reply Last reply Reply Quote 0
                                    • B
                                      Burnie
                                      last edited by

                                      @Emarl: great work. snort seems to be working great now. (i386/2.0RC1)

                                      I found two things that didn't seem right:

                                      1. filenames of md5 files in /usr/local/www/snort/snort_download_updates.php seem wrong:

                                      
                                      --- /usr/local/www/snort/snort_download_updates.php.orig	2011-08-04 22:03:35.000000000 +0200
                                      +++ /usr/local/www/snort/snort_download_updates.php	2011-08-04 22:04:35.000000000 +0200
                                      @@ -47,5 +47,5 @@
                                       /* quick md5s chk */
                                      -if(file_exists('/usr/local/etc/snort/snortrules-snapshot-2860.tar.gz.md5'))
                                      +if(file_exists('/usr/local/etc/snort/snortrules-snapshot-2861.tar.gz.md5'))
                                       {
                                      -	$snort_org_sig_chk_local = exec('/bin/cat /usr/local/etc/snort/snortrules-snapshot-2860.tar.gz.md5');
                                      +	$snort_org_sig_chk_local = exec('/bin/cat /usr/local/etc/snort/snortrules-snapshot-2861.tar.gz.md5');
                                       }else{
                                      @@ -54,5 +54,5 @@
                                      
                                      -if(file_exists('/usr/local/etc/snort/version.txt'))
                                      +if(file_exists('/usr/local/etc/snort/emerging.rules.tar.gz.md5'))
                                       {
                                      -	$emergingt_net_sig_chk_local = exec('/bin/cat /usr/local/etc/snort/version.txt');
                                      +	$emergingt_net_sig_chk_local = exec('/bin/cat /usr/local/etc/snort/emerging.rules.tar.gz.md5');
                                       }else{
                                      
                                      

                                      2. Trying to enable barnyard2, when I clicked save, it said it couldn't write to
                                        /usr/local/etc/snort/snort__re1/barnyard2.conf
                                          and then all config of snort were gone…
                                          I guess somewhere it lost $iface_uuid, as I suspect it meant to write to
                                        _  /usr/local/etc/snort/snort_6162_re1/barnyard2.conf_

                                      (I haven't had time to dig into the last one just yet)

                                      1 Reply Last reply Reply Quote 0
                                      • E
                                        eri--
                                        last edited by

                                        I have not touched barnyard at all, :(.

                                        I know there are some other issues in the code but general functionality is ok.
                                        I will check what i can do to progress on this but support is most definitely a welcome addition :)

                                        BTW: my name is Ermal and not Emarl

                                        EDIT:
                                        @Burnie
                                        imported your fix in the package, thx.

                                        @Cino,

                                        fixed the warnings you mentioned.

                                        1 Reply Last reply Reply Quote 0
                                        • A
                                          asterix
                                          last edited by

                                          Ermal, any amd64 support?

                                          1 Reply Last reply Reply Quote 0
                                          • E
                                            eri--
                                            last edited by

                                            The amd64 support is there but look at redmine.pfsense.org under snort category of issues on pfSense-packages project.
                                            I am trying to put there all known issues though solving those is not only based on my or pfSense good will :), some help is needed as well.

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.