Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Snort 2.9.1 pkg v. 2.1.1 Error.

    Scheduled Pinned Locked Moved pfSense Packages
    88 Posts 27 Posters 37.9k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • S
      srainsdon
      last edited by

      having the same #3 error "FATAL ERROR: ByteExtract variable '^Authorization\x3A\s*Basic[ \t]+' in rule [3:13308] is used before it is defined." having all rules unchecked

      1 Reply Last reply Reply Quote 0
      • D
        DigitalDeviant
        last edited by

        @srainsdon:

        having the same #3 error "FATAL ERROR: ByteExtract variable '^Authorization\x3A\s*Basic[ \t]+' in rule [3:13308] is used before it is defined." having all rules unchecked

        I had the same error and had to delete the contents of /usr/local/lib/snort/dynamicrules. After that everything seemed fine and all my rules seem to work.

        1 Reply Last reply Reply Quote 0
        • S
          srainsdon
          last edited by

          Thanks DigitalDeviant that worked nicely.

          1 Reply Last reply Reply Quote 0
          • B
            borgotech
            last edited by

            I use ony Emmerging Rules and snort works fine… until this bug will be fixed.

            Best Regards

            1 Reply Last reply Reply Quote 0
            • C
              Cino
              last edited by

              there were some changes made to the snort package to remove anything that was left behind… I did a reinstall and was able to download snorts ruleset and start a few up with no issues... I didn't check every rule since I only use a handful.

              1 Reply Last reply Reply Quote 0
              • C
                Cino
                last edited by

                try reinstalling now… looks like it is fixed

                1 Reply Last reply Reply Quote 0
                • M
                  miles267
                  last edited by

                  @DigitalDeviant:

                  @srainsdon:

                  having the same #3 error "FATAL ERROR: ByteExtract variable '^Authorization\x3A\s*Basic[ \t]+' in rule [3:13308] is used before it is defined." having all rules unchecked

                  I had the same error and had to delete the contents of /usr/local/lib/snort/dynamicrules. After that everything seemed fine and all my rules seem to work.

                  This works provided you're only using EMERGING rule set.  Is there a fix that enables you to also use SNORT rules?

                  1 Reply Last reply Reply Quote 0
                  • S
                    sronsen
                    last edited by

                    @srainsdon:

                    having the same #3 error "FATAL ERROR: ByteExtract variable '^Authorization\x3A\s*Basic[ \t]+' in rule [3:13308] is used before it is defined." having all rules unchecked

                    Solved this by disabling all rules in snort_web-misc.so.rules category - EVEN THOUGH THIS CATEGORY WAS UNCHECKED IN CATEGORIES SCREEN.  I thought that only rules from checked categories were enabled.  Am I missing something, besides an illogical brain?

                    Update:  Error reappeared after 12+ hours.  No solution yet!

                    1 Reply Last reply Reply Quote 0
                    • G
                      Gradius
                      last edited by

                      It was running fine, until I updated today to last snapshot.

                      Now it won't start anymore, please check it out.

                      1 Reply Last reply Reply Quote 0
                      • G
                        Gradius
                        last edited by

                        Here is the problem:
                        Jun 12 13:20:43  snort[26817]: FATAL ERROR: parser.c(5245) Could not stat dynamic module path "/usr/local/lib/snort/dynamicpreprocessor": No such file or directory.
                        Jun 12 13:20:43  snort[26817]: FATAL ERROR: parser.c(5245) Could not stat dynamic module path "/usr/local/lib/snort/dynamicpreprocessor": No such file or directory.

                        1 Reply Last reply Reply Quote 0
                        • G
                          Gradius
                          last edited by

                          I uninstalled, re-installed, tried:
                          1.) ln -s /lib/libpcap.so.7 /lib/libpcap.so.1
                          2.) ln -s /usr/local/lib/snort/dynamicpreprocessor /usr/local/lib/snort_dynamicpreprocessor
                          3.) ln -s /usr/local/lib/snort/dynamicengine /usr/local/lib/snort_dynamicengine
                          4.) ln -s /usr/local/lib/snort/dynamicrules /usr/local/lib/snort_dynamicrules
                          5.) manually update the Snort rules.
                          6.) touch /usr/local/etc/snort/rules/local.rules

                          Disabled everything on "Preprocessors" tab, nothing!

                          It refuses to run, this problem just "popped" today from last snapshot update.  :(

                          1 Reply Last reply Reply Quote 0
                          • G
                            Gradius
                            last edited by

                            This is all on it:

                            
[2.1-BETA0][root@*****]/usr/local/lib/snort(8): ls -laR
total 8
drwxr-xr-x   3 root  wheel   512 Jun 12 13:38 .
drwxr-xr-x  14 root  wheel  3584 Jun 12 13:38 ..
drwxr-xr-x   2 root  wheel   512 Jun 12 13:38 dynamicrules

./dynamicrules:
total 4
drwxr-xr-x  2 root  wheel  512 Jun 12 13:38 .
drwxr-xr-x  3 root  wheel  512 Jun 12 13:38 ..
                            1 Reply Last reply Reply Quote 0
                            • C
                              condector
                              last edited by

                              Man.. after update… the alert page (snort_alerts.php) apear blank when I try see the alerts generated.

                              1 Reply Last reply Reply Quote 0
                              • G
                                Gradius
                                last edited by

                                It only happened today, at update:
                                2.1-BETA0 (i386)
                                built on Tue Jun 12 05:15:27 EDT 2012
                                FreeBSD 8.3-RELEASE-p2

                                Snort package: 2.9.2.3 pkg v.2.1.1

                                1 Reply Last reply Reply Quote 0
                                • A
                                  asterix
                                  last edited by

                                  Same issue here..

                                  Jun 12 14:44:53 snort[54702]: FATAL ERROR: parser.c(5302) Could not stat dynamic module path "/usr/local/lib/snort/dynamicpreprocessor": No such file or directory.
                                  Jun 12 14:44:53 snort[54702]: FATAL ERROR: parser.c(5302) Could not stat dynamic module path "/usr/local/lib/snort/dynamicpreprocessor": No such file or directory.

                                  1 Reply Last reply Reply Quote 0
                                  • G
                                    Gradius
                                    last edited by

                                    Checking snort.conf I found:

                                    dynamicpreprocessor directory /usr/local/lib/snort_dynamicpreprocessor/
                                    dynamicengine /usr/local/lib/snort_dynamicengine/libsf_engine.so
                                    dynamicdetection directory /usr/local/lib/snort_dynamicrules

                                    However, there is nothing on /usr/local/lib/snort_dynamicpreprocessor (as I listed above).

                                    There is NO libsf_engine.so file at all on system!

                                    Only /usr/local/lib/snort_dynamicrules exists (as directory only, but there is nothing inside on it too).

                                    1 Reply Last reply Reply Quote 0
                                    • C
                                      Cino
                                      last edited by

                                      uninstall snort
                                      drop down to shell
                                      run 'find /* | grep snort'
                                      delete every reference
                                      install snort
                                      update rules
                                      Click save on every page, Global page for sure, so the cron job is added
                                      make sure every preprocessor is ON

                                      that should do it, at least for i386… can't help with amd64 builds... and in the past, amd64 always had problems with snort for some reason

                                      1 Reply Last reply Reply Quote 0
                                      • G
                                        Gradius
                                        last edited by

                                        I'm getting this now:
                                        Jun 12 16:42:17 php: /status_services.php: The command '/usr/local/etc/rc.d/snort.sh stop' returned exit code '1', the output was 'rm: /tmp/snort.sh.pid: No such file or directory rm: /var/run/snort*: No such file or directory'

                                        I even rebooted, no joy.

                                        1 Reply Last reply Reply Quote 0
                                        • T
                                          taryezveb
                                          last edited by

                                          @Cino:

                                          uninstall snort
                                          drop down to shell
                                          run 'find /* | grep snort'

                                          In case the Snort devs do not know this. Or maybe it is just me?

                                          Code:

                                          Installation of snort FAILED!
                                          delete every reference
                                          install snort
                                          update rules
                                          Click save on every page, Global page for sure, so the cron job is added
                                          make sure every preprocessor is ON

                                          that should do it, at least for i386… can't help with amd64 builds... and in the past, amd64 always had problems with snort for some reason

                                          The above worked for me using a amd64 install. Needed to do this, since the snort rules would not get updated.

                                          Used the following instead of, [find /* | grep snort]:

                                          find /* | grep -i snort | xargs rm -rv

                                          EDIT: Thanks Cino for the info :)

                                          When I finished setting up snort, noticed there was a new version:

                                          Stable	
2.9.2.3 pkg v. 2.2
platform: 2.0

                                          But the new version fails to install:

                                          Installation of snort FAILED!

Beginning package installation for snort...
Downloading package configuration file... done.
Saving updated package information... done.
Downloading snort and its dependencies... 
Checking for package installation... 
 Downloading http://files.pfsense.org/packages/amd64/8/All/barnyard2-1.9_2.tbz ...  could not download from there or http://ftp2.FreeBSD.org/pub/FreeBSD/ports/amd64/packages-8.1-release/All/barnyard2-1.9_2.tbz.
of barnyard2-1.9_2 failed!

Installation aborted.Backing up libraries... 
Removing package...
Starting package deletion for mysql-client-5.1.53...done.
Starting package deletion for barnyard2-1.9_2...done.
Starting package deletion for snort-2.9.2.3...done.
Starting package deletion for perl-threaded-5.12.4_4...done.
Removing snort components...
Menu items... done.
Services... done.
Loading package instructions...
Include file snort.inc could not be found for inclusion.
Deinstall commands... 
Not executing custom deinstall hook because an include is missing.
Removing package instructions...done.
Auxiliary files... done.
Package XML... done.
Configuration... done.
Cleaning up... Failed to install package.

Installation halted.
                                          1 Reply Last reply Reply Quote 0
                                          • C
                                            Cino
                                            last edited by

                                            noticed that too. barnyard2-1.9_2.tbz isnt built yet.. once its built, you should be good to go

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.