Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Snort stops working after snort update (newest 2.0 RELEASE)

    Scheduled Pinned Locked Moved pfSense Packages
    113 Posts 25 Posters 64.1k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • C
      Cino
      last edited by

      @pfsenseddc:

      @Cino:

      (…)
      Looking at the change [that pfsenseddc made] , its just adding a delay to the restart process.
      (…)

      The ten seconds delay  probably does not matter. The important part is replacing 'kill -HUP' with 'kill [-TERM]'.

      Regards,
      –
      John

      The only change that ermal made was to add a the 10 sec delay… "kill -HUP' with 'kill [-TERM]" was not added to the package

      https://github.com/bsdperimeter/pfsense-packages/commit/cecd19f0a2843d104465b792018c005d113b5ed5

      1 Reply Last reply Reply Quote 0
      • B
        bdwyer
        last edited by

        @pfsenseddc:

        @Cino:

        (…)
        Looking at the change [that pfsenseddc made] , its just adding a delay to the restart process.
        (…)

        The ten seconds delay  probably does not matter. The important part is replacing 'kill -HUP' with 'kill [-TERM]'.

        Regards,
        –
        John

        I guess this is why I still have the issue with it not restarting after updates even after reinstalling Snort.  When I manually make that edit it seems to work fine.  They only added the 10 second delay not the kill line.

        CCNP, MCITP

        Intel Atom N550 - 2gb DDR3
        Jetway NC9C-550-LF
        Antec ISK 300-150
        HP ProCurve 1810-24
        Cisco 1841 & 2821, Cisco 3550 x3

        1 Reply Last reply Reply Quote 0
        • E
          eri--
          last edited by

          Reinstall the package at least the reloading should be correct now and snort should not exit anymore as reported here.

          1 Reply Last reply Reply Quote 0
          • D
            dhatz
            last edited by

            It seems that compiling snort with –enable-reload will allow snort to reload on receiving a SIGHUP without requiring it to be running as root.

            http://groups.google.com/group/pulledpork-users/browse_thread/thread/00acf6e138df1a07

            I run my snort instances as -u snorty.. sending a HUP from root works fine
            for me and has, it is much cleaner now though than the –enable-reload
            option has been added (and I configured with that) into snort.

            On Tue, Jan 26, 2010 at 5:00 PM, William wil...@gmail.comwrote:

            It doesn't seem to matter if I am root or not when I send the HUP.
            What seems to make a difference is whether or not snort itself is
            running as root or as another user (eg. started as snort -u
            someotheruser).  If it is NOT running as root, then snort will respond
            with the "Reload via Signal HUP..." message and not re-read its
            config.
            I posted a similar question to the Snort users list and someone from
            Sourcefire explained the reasoning (snort needs to open pcap again,
            which requires root privileges)/wil...@gmail.com

            1 Reply Last reply Reply Quote 0
            • E
              eri--
              last edited by

              Well i fixed the FreeBSD package used on pfSense to compile snort with the proper flags to restart on reload error rather than exit since the present binary will just plain exit on reload errors.

              I honestly do not think that it will really work properly reloading not as root user so i am not reverting that change.

              Tomorrow the binary should be updated and the fixes done today should fix the report.

              1 Reply Last reply Reply Quote 0
              • C
                Cino
                last edited by

                @ermal:

                Well i fixed the FreeBSD package used on pfSense to compile snort with the proper flags to restart on reload error rather than exit since the present binary will just plain exit on reload errors.

                I honestly do not think that it will really work properly reloading not as root user so i am not reverting that change.

                Tomorrow the binary should be updated and the fixes done today should fix the report.

                @ermal

                I believe the snort_interfaces.php needs to be updated to correctly display snort status. With the changes you just made, snort stated but snort_interfaces.php page states that its not started. The services page, does show that snort is running and i see the process running in the background.

                Also, snort isn't auto-starting anymore upon reboot. nothing in my log or on the console

                Unless the new binary is needed for the changes you made to resolve the 2 issues i noticed.

                As a side-note… With changes made to the 2.1 code to use pbi I notice that that my box didn't download snort binaries this afternoon. Example: I uninstalled snort, noticed that snort-2.8.6.1 and snort-2.9.0.5 where still listed under pkg_info. I manually deleted them using pkg_delete.. Rebooted the box, installed snort and did a rule update. Looked at my log and only had 4 snort entries. I looked to see if the binaries where under /usr/local/bin... Nothing, so i added snort package via pkg_add -r http://files.pfsense.org/packages/8/All/snort-2.9.0.5.tbz and then was able to get snort to start...

                just wondering if I should do the same tomorrow to get the new binaries.

                As always, thanks for all your support on the snort package

                Edit:

                When i run  /usr/local/etc/rc.d/snort.sh restart
                i'm seeing these errors:

                
                ls: /tmp/snort.sh.pid: No such file or directory
                rm: /tmp/snort.sh.pid: No such file or directory
                rm: /var/run/snort*: No such file or directory
                ls: /tmp/snort.sh.pid: No such file or directory
                rm: /var/run/snort_39737_em3.pid: No such file or directory
                
                

                When i run  /usr/local/etc/rc.d/snort.sh start
                just:

                
                ls: /tmp/snort.sh.pid: No such file or directory
                
                

                i thought the pid and such were stored at '/var/log/snort/run'?

                1 Reply Last reply Reply Quote 0
                • E
                  eri--
                  last edited by

                  Those errors are harmless.
                  That code is not very trustworthy but no time to make it proper use pidfiles.

                  The chnages i made has nothing in relation to what you report on snort_interfaces.php.

                  1 Reply Last reply Reply Quote 0
                  • C
                    Cino
                    last edited by

                    i'll have to do some more testing and look over the code because i can't seem to get snort_interfaces.php to show that snort is running..

                    like i said, i can't get snort to run when type "/usr/local/etc/rc.d/snort.sh" start but i able to get it to start running "/usr/local/etc/rc.d/snort.sh start_real"
                    Would this be the reason why it wont auto-start on reboot?

                    1 Reply Last reply Reply Quote 0
                    • E
                      eri--
                      last edited by

                      Try again reinstalling.

                      Seems the code generated for the snort.sh was as always full of surprises :)

                      1 Reply Last reply Reply Quote 0
                      • RonpfSR
                        RonpfS
                        last edited by

                        Removed snort, installed snort
                        this vanished

                        		 <minute>3</minute>
                        			<hour>0</hour>
                        			<mday>*/1</mday>
                        			<month>*</month>
                        			<wday>*</wday>
                        			<who>root</who>
                        			<command></command>/usr/bin/nice -n20 /usr/local/bin/php -f /usr/local/pkg/snort/snort_check_for_rule_updates.php >> /tmp/snort_update.log 
                        		 <minute>*/15</minute>
                        			<hour>*</hour>
                        			<mday>*</mday>
                        			<month>*</month>
                        			<wday>*</wday>
                        			<who>root</who>
                        			<command></command>/usr/bin/nice -n20 /usr/local/sbin/expiretable -t 10800 snort2c 
                        

                        I save in the Global settings it showed up again like this

                        		 <minute>*/15</minute>
                        			<hour>*</hour>
                        			<mday>*</mday>
                        			<month>*</month>
                        			<wday>*</wday>
                        			<who>root</who>
                        			<command></command>/usr/bin/nice -n20 /usr/local/sbin/expiretable -t 10800 snort2c 
                        		 <minute>3</minute>
                        			<hour>0</hour>
                        			<mday>*/1</mday>
                        			<month>*</month>
                        			<wday>*</wday>
                        			<who>root</who>
                        			<command></command>/usr/bin/nice -n20 /usr/local/bin/php -f /usr/local/pkg/snort/snort_check_for_rule_updates.php >> /tmp/snort_update.log 
                        

                        I ran Update and snort started, trigger Alerts and Blocks IP ;o)  ;D
                        maybe if I ran Update first, the crontab entry might have reappeared.

                        However, the Snort Interface shows a GREEN arrow, RED Wan,
                        the If settings show a start button.
                        But snort is running as root in System Activity
                        Snort is showed running under Services. Stopping snort under Services requires a refresh to update the status to not running
                        You also have to refresh Dashboard to see the updated snort status. Starting snort in  Dashboard failed

                        I started Snort under Services: Snort work ok.

                        During all that time, the Snort Interface ALLWAYS shows a GREEN arrow, RED Wan

                        The midnight update went fine and snort reloaded without problem.  ::)

                        2.4.5-RELEASE-p1 (amd64)
                        Intel Core2 Quad CPU Q8400 @ 2.66GHz 8GB
                        Backup 0.5_5, Bandwidthd 0.7.4_4, Cron 0.3.7_5, pfBlockerNG-devel 3.0.0_16, Status_Traffic_Totals 2.3.1_1, System_Patches 1.2_5

                        1 Reply Last reply Reply Quote 0
                        • C
                          Cino
                          last edited by

                          that seem to do it! thanks again.

                          I trying to figure out why i'm not seeing it up. You didn't make any changes to the page(and snort_interfaces_edit.php) but they are not reporting status correctly.

                          I'm wondering because root is running snort is it failing the few checks i see not idk.

                          1 Reply Last reply Reply Quote 0
                          • C
                            Cino
                            last edited by

                            @RonpfS  Every time you reinstall snort, save the global settings page for it to re-create the cron job.. This has been normal practice since snort was fixed a few months back.

                            I'm having the same issue with the snort_interface.php showing the status of snort.

                            1 Reply Last reply Reply Quote 0
                            • S
                              serialdie
                              last edited by

                              Any body seen that snort is using more mem than before?

                              Using ac-std with just 3 categories enable…. my mem goes to 58% where before it was only like 28% any ideas?

                              1 Reply Last reply Reply Quote 0
                              • B
                                bdwyer
                                last edited by

                                I too now have the issue with Snort not being seen as running, although it is.

                                CCNP, MCITP

                                Intel Atom N550 - 2gb DDR3
                                Jetway NC9C-550-LF
                                Antec ISK 300-150
                                HP ProCurve 1810-24
                                Cisco 1841 & 2821, Cisco 3550 x3

                                1 Reply Last reply Reply Quote 0
                                • RonpfSR
                                  RonpfS
                                  last edited by

                                  I just changed the WAN ip and snort failed with

                                  2011-11-10 22:50:24	Daemon.Error	x.x.x.x	snort[41456]: FATAL ERROR: /usr/local/etc/snort/snort_18203_pppoe0/snort.conf(356) Invalid configuration line: s
                                  2011-11-10 22:50:24	Daemon.Info	x.x.x.x	SnortStartup[6772]: Snort HARD START For 18203_pppoe0...
                                  

                                  Start manual is ok …

                                  2.4.5-RELEASE-p1 (amd64)
                                  Intel Core2 Quad CPU Q8400 @ 2.66GHz 8GB
                                  Backup 0.5_5, Bandwidthd 0.7.4_4, Cron 0.3.7_5, pfBlockerNG-devel 3.0.0_16, Status_Traffic_Totals 2.3.1_1, System_Patches 1.2_5

                                  1 Reply Last reply Reply Quote 0
                                  • E
                                    eri--
                                    last edited by

                                    Fixed the display on the GUI and snort reload on ip change.

                                    Now who will send me beer?!

                                    Of course you need to reinstall.

                                    1 Reply Last reply Reply Quote 0
                                    • C
                                      Cino
                                      last edited by

                                      Notice work I me an other user have found an issue with the interface.php page http://forum.pfsense.org/index.php/topic,42955.msg221944.html#msg221944

                                      When i try to start from the interface page, i get the below error, the file location is doubled

                                      snort[4101]: FATAL ERROR: Unable to open rules file "/usr/local/etc/snort/snort_39737_em3//usr/local/etc/snort/snort_39737_em3/rules/emerging-attack_response.rules": No such file or directory.

                                      if i reboot the box or do a manually rule update, snort starts fine

                                      Also, did the new binaries compile over night? I look under http://files.pfsense.org/packages/8/All/ and the date stamp didn't change. As i said in a previous post, my box isn't downloading binaries anymore and i think it has to do with the future pbi that is coming when 2.1 is on freebsd 9.

                                      p.s you like pale ale's

                                      1 Reply Last reply Reply Quote 0
                                      • E
                                        eri--
                                        last edited by

                                        Post your snort.conf since nothing has changed there!
                                        Apart that PBI installs iirc snort 2.9.1

                                        1 Reply Last reply Reply Quote 0
                                        • C
                                          Cino
                                          last edited by

                                          @ermal:

                                          Post your snort.conf since nothing has changed there!
                                          Apart that PBI installs iirc snort 2.9.1

                                          Dont know if this helps: When I stop snort via the interface page, it deletes /usr/local/etc/snort/snort_39737_em3 folder. When i try to start it, it doesn't create it.. So thats why snort wont start. BUT if I do a manually update of the rules, it creates the folder and snort is able to start again

                                          1 Reply Last reply Reply Quote 0
                                          • E
                                            eri--
                                            last edited by

                                            Fixed.
                                            Try after 15 minutes.

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.