Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Snort stops working after snort update (newest 2.0 RELEASE)

    Scheduled Pinned Locked Moved pfSense Packages
    113 Posts 25 Posters 64.1k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • B
      bdwyer
      last edited by

      I too now have the issue with Snort not being seen as running, although it is.

      CCNP, MCITP

      Intel Atom N550 - 2gb DDR3
      Jetway NC9C-550-LF
      Antec ISK 300-150
      HP ProCurve 1810-24
      Cisco 1841 & 2821, Cisco 3550 x3

      1 Reply Last reply Reply Quote 0
      • RonpfSR
        RonpfS
        last edited by

        I just changed the WAN ip and snort failed with

        2011-11-10 22:50:24	Daemon.Error	x.x.x.x	snort[41456]: FATAL ERROR: /usr/local/etc/snort/snort_18203_pppoe0/snort.conf(356) Invalid configuration line: s
        2011-11-10 22:50:24	Daemon.Info	x.x.x.x	SnortStartup[6772]: Snort HARD START For 18203_pppoe0...
        

        Start manual is ok …

        2.4.5-RELEASE-p1 (amd64)
        Intel Core2 Quad CPU Q8400 @ 2.66GHz 8GB
        Backup 0.5_5, Bandwidthd 0.7.4_4, Cron 0.3.7_5, pfBlockerNG-devel 3.0.0_16, Status_Traffic_Totals 2.3.1_1, System_Patches 1.2_5

        1 Reply Last reply Reply Quote 0
        • E
          eri--
          last edited by

          Fixed the display on the GUI and snort reload on ip change.

          Now who will send me beer?!

          Of course you need to reinstall.

          1 Reply Last reply Reply Quote 0
          • C
            Cino
            last edited by

            Notice work I me an other user have found an issue with the interface.php page http://forum.pfsense.org/index.php/topic,42955.msg221944.html#msg221944

            When i try to start from the interface page, i get the below error, the file location is doubled

            snort[4101]: FATAL ERROR: Unable to open rules file "/usr/local/etc/snort/snort_39737_em3//usr/local/etc/snort/snort_39737_em3/rules/emerging-attack_response.rules": No such file or directory.

            if i reboot the box or do a manually rule update, snort starts fine

            Also, did the new binaries compile over night? I look under http://files.pfsense.org/packages/8/All/ and the date stamp didn't change. As i said in a previous post, my box isn't downloading binaries anymore and i think it has to do with the future pbi that is coming when 2.1 is on freebsd 9.

            p.s you like pale ale's

            1 Reply Last reply Reply Quote 0
            • E
              eri--
              last edited by

              Post your snort.conf since nothing has changed there!
              Apart that PBI installs iirc snort 2.9.1

              1 Reply Last reply Reply Quote 0
              • C
                Cino
                last edited by

                @ermal:

                Post your snort.conf since nothing has changed there!
                Apart that PBI installs iirc snort 2.9.1

                Dont know if this helps: When I stop snort via the interface page, it deletes /usr/local/etc/snort/snort_39737_em3 folder. When i try to start it, it doesn't create it.. So thats why snort wont start. BUT if I do a manually update of the rules, it creates the folder and snort is able to start again

                1 Reply Last reply Reply Quote 0
                • E
                  eri--
                  last edited by

                  Fixed.
                  Try after 15 minutes.

                  1 Reply Last reply Reply Quote 0
                  • C
                    Cino
                    last edited by

                    @ermal:

                    Fixed.
                    Try after 15 minutes.

                    looking good man! i'll do some more testing later today. also, since i never tested this for you before; barnyard2 is reporting data to my windows mysql server. I did have to manually copy the barnyard2 file from file.pfsense.org to get it on my box but i don't know if that's because its not in the package install or the issue I'm having with my box not pulling down binaries.

                    I don't think the new snort binary has been complied yet… I dont them on files.pfsense.org... also for the pbi, they look to be 2.9.1 but i'll have to wait for a freebsd9 snapshot before i can test

                    1 Reply Last reply Reply Quote 0
                    • RonpfSR
                      RonpfS
                      last edited by

                      Removed and installed Services: Snort 2.9.1 pkg v. 2.0

                      I did see 2.9.0.5.tar during the install ??

                      Now the status is ok in the GUI.
                      I changed the WAN IP and snort restarted fine  ::)

                      Thank you

                      2.4.5-RELEASE-p1 (amd64)
                      Intel Core2 Quad CPU Q8400 @ 2.66GHz 8GB
                      Backup 0.5_5, Bandwidthd 0.7.4_4, Cron 0.3.7_5, pfBlockerNG-devel 3.0.0_16, Status_Traffic_Totals 2.3.1_1, System_Patches 1.2_5

                      1 Reply Last reply Reply Quote 0
                      • E
                        eri--
                        last edited by

                        I will need some beer together with pfSense.org guys to continue improve this more :)

                        Hope people put some effort into donation as they do in the reporting of issues ;)

                        1 Reply Last reply Reply Quote 0
                        • D
                          dhatz
                          last edited by

                          Ermal, you are right of course.

                          Considering that according to recent blog post pfsense has recently surpassed 100k active installs, there should be a better way to fund projects than posting in the Bounty forum and waiting a couple of weeks for others to join in, since apparently a very small fraction of pfsense users reads these forums regularly.

                          I'm thinking of a funding platform like http://www.indiegogo.com/ (just the concept) coupled with a way for people to vote up/down on features (e.g. feature.astaro.com)

                          1 Reply Last reply Reply Quote 0
                          • C
                            Cino
                            last edited by

                            @RonpfS 2.9.0.5 is the correct file for install for 2.0 installs. I have 2.1 development code installed on my box for testing…

                            @Ermal  I sent some money this morning... Bug Scott for a case or 2 :-)

                            1 Reply Last reply Reply Quote 0
                            • E
                              eri--
                              last edited by

                              Thanks Cino, much appreciated.

                              1 Reply Last reply Reply Quote 0
                              • RonpfSR
                                RonpfS
                                last edited by

                                I forgot to do a save after the last install   :-[ No entry was expiring !!!

                                [quote author=Cino link=topic=41533.msg221876#msg221876 date=1320973760]
                                @RonpfS  Every time you reinstall snort, save the global settings page for it to re-create the cron job.. This has been normal practice since snort was fixed a few months back.

                                This could be emphasized with a BIG MESSAGE
                                in the System: Package Manager Installer or Services: Snort: Updates window.

                                Why not 'automatic global settings save' when you click the Update Rules Button??

                                2.4.5-RELEASE-p1 (amd64)
                                Intel Core2 Quad CPU Q8400 @ 2.66GHz 8GB
                                Backup 0.5_5, Bandwidthd 0.7.4_4, Cron 0.3.7_5, pfBlockerNG-devel 3.0.0_16, Status_Traffic_Totals 2.3.1_1, System_Patches 1.2_5

                                1 Reply Last reply Reply Quote 0
                                • S
                                  serialdie
                                  last edited by

                                  Any body having issues with memory when snort is running?

                                  1 Reply Last reply Reply Quote 0
                                  • R
                                    robheid
                                    last edited by

                                    I updated today to version 2.9.1 pkg v. 2.0 and after a rules update snort isnt starting and i get the following message: snort[3689]: FATAL ERROR: /usr/local/etc/snort/snort_15641_em0/snort.conf(320) Unknown output plugin: "alert_pf"

                                    What can i do to fix this?

                                    1 Reply Last reply Reply Quote 0
                                    • RonpfSR
                                      RonpfS
                                      last edited by

                                      Try to remove, then Install

                                      2.4.5-RELEASE-p1 (amd64)
                                      Intel Core2 Quad CPU Q8400 @ 2.66GHz 8GB
                                      Backup 0.5_5, Bandwidthd 0.7.4_4, Cron 0.3.7_5, pfBlockerNG-devel 3.0.0_16, Status_Traffic_Totals 2.3.1_1, System_Patches 1.2_5

                                      1 Reply Last reply Reply Quote 0
                                      • R
                                        robheid
                                        last edited by

                                        I have done that and keep getting the same error.

                                        1 Reply Last reply Reply Quote 0
                                        • RonpfSR
                                          RonpfS
                                          last edited by

                                          If your look at the file /usr/local/etc/snort/snort_15641_em0/snort.conf

                                          you will should find something like that:

                                          output alert_pf: /usr/local/etc/snort/whitelist/Blablabla,snort2c
                                          
                                          

                                          so maybe your whilelist is incorrect or snort2c is corrupted, try to look at them in Diagnostics: Tables
                                          Try to clear the Alert and Blocked
                                          You could also start from scratch:
                                          Uncheck Keep snort settings after deinstall, Save, Reset, Save, remove snort, install snort

                                          2.4.5-RELEASE-p1 (amd64)
                                          Intel Core2 Quad CPU Q8400 @ 2.66GHz 8GB
                                          Backup 0.5_5, Bandwidthd 0.7.4_4, Cron 0.3.7_5, pfBlockerNG-devel 3.0.0_16, Status_Traffic_Totals 2.3.1_1, System_Patches 1.2_5

                                          1 Reply Last reply Reply Quote 0
                                          • R
                                            robheid
                                            last edited by

                                            snort2c is empty. is that the problem?

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.