Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Snort 2.9.1 pkg v. 2.1.1 Error.

    Scheduled Pinned Locked Moved pfSense Packages
    88 Posts 27 Posters 39.5k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • B
      borgotech
      last edited by

      I use ony Emmerging Rules and snort works fine… until this bug will be fixed.

      Best Regards

      1 Reply Last reply Reply Quote 0
      • C
        Cino
        last edited by

        there were some changes made to the snort package to remove anything that was left behind… I did a reinstall and was able to download snorts ruleset and start a few up with no issues... I didn't check every rule since I only use a handful.

        1 Reply Last reply Reply Quote 0
        • C
          Cino
          last edited by

          try reinstalling now… looks like it is fixed

          1 Reply Last reply Reply Quote 0
          • M
            miles267
            last edited by

            @DigitalDeviant:

            @srainsdon:

            having the same #3 error "FATAL ERROR: ByteExtract variable '^Authorization\x3A\s*Basic[ \t]+' in rule [3:13308] is used before it is defined." having all rules unchecked

            I had the same error and had to delete the contents of /usr/local/lib/snort/dynamicrules. After that everything seemed fine and all my rules seem to work.

            This works provided you're only using EMERGING rule set.  Is there a fix that enables you to also use SNORT rules?

            1 Reply Last reply Reply Quote 0
            • S
              sronsen
              last edited by

              @srainsdon:

              having the same #3 error "FATAL ERROR: ByteExtract variable '^Authorization\x3A\s*Basic[ \t]+' in rule [3:13308] is used before it is defined." having all rules unchecked

              Solved this by disabling all rules in snort_web-misc.so.rules category - EVEN THOUGH THIS CATEGORY WAS UNCHECKED IN CATEGORIES SCREEN.  I thought that only rules from checked categories were enabled.  Am I missing something, besides an illogical brain?

              Update:  Error reappeared after 12+ hours.  No solution yet!

              1 Reply Last reply Reply Quote 0
              • G
                Gradius
                last edited by

                It was running fine, until I updated today to last snapshot.

                Now it won't start anymore, please check it out.

                1 Reply Last reply Reply Quote 0
                • G
                  Gradius
                  last edited by

                  Here is the problem:
                  Jun 12 13:20:43  snort[26817]: FATAL ERROR: parser.c(5245) Could not stat dynamic module path "/usr/local/lib/snort/dynamicpreprocessor": No such file or directory.
                  Jun 12 13:20:43  snort[26817]: FATAL ERROR: parser.c(5245) Could not stat dynamic module path "/usr/local/lib/snort/dynamicpreprocessor": No such file or directory.

                  1 Reply Last reply Reply Quote 0
                  • G
                    Gradius
                    last edited by

                    I uninstalled, re-installed, tried:
                    1.) ln -s /lib/libpcap.so.7 /lib/libpcap.so.1
                    2.) ln -s /usr/local/lib/snort/dynamicpreprocessor /usr/local/lib/snort_dynamicpreprocessor
                    3.) ln -s /usr/local/lib/snort/dynamicengine /usr/local/lib/snort_dynamicengine
                    4.) ln -s /usr/local/lib/snort/dynamicrules /usr/local/lib/snort_dynamicrules
                    5.) manually update the Snort rules.
                    6.) touch /usr/local/etc/snort/rules/local.rules

                    Disabled everything on "Preprocessors" tab, nothing!

                    It refuses to run, this problem just "popped" today from last snapshot update.  :(

                    1 Reply Last reply Reply Quote 0
                    • G
                      Gradius
                      last edited by

                      This is all on it:

                      
[2.1-BETA0][root@*****]/usr/local/lib/snort(8): ls -laR
total 8
drwxr-xr-x   3 root  wheel   512 Jun 12 13:38 .
drwxr-xr-x  14 root  wheel  3584 Jun 12 13:38 ..
drwxr-xr-x   2 root  wheel   512 Jun 12 13:38 dynamicrules

./dynamicrules:
total 4
drwxr-xr-x  2 root  wheel  512 Jun 12 13:38 .
drwxr-xr-x  3 root  wheel  512 Jun 12 13:38 ..
                      1 Reply Last reply Reply Quote 0
                      • C
                        condector
                        last edited by

                        Man.. after update… the alert page (snort_alerts.php) apear blank when I try see the alerts generated.

                        1 Reply Last reply Reply Quote 0
                        • G
                          Gradius
                          last edited by

                          It only happened today, at update:
                          2.1-BETA0 (i386)
                          built on Tue Jun 12 05:15:27 EDT 2012
                          FreeBSD 8.3-RELEASE-p2

                          Snort package: 2.9.2.3 pkg v.2.1.1

                          1 Reply Last reply Reply Quote 0
                          • A
                            asterix
                            last edited by

                            Same issue here..

                            Jun 12 14:44:53 snort[54702]: FATAL ERROR: parser.c(5302) Could not stat dynamic module path "/usr/local/lib/snort/dynamicpreprocessor": No such file or directory.
                            Jun 12 14:44:53 snort[54702]: FATAL ERROR: parser.c(5302) Could not stat dynamic module path "/usr/local/lib/snort/dynamicpreprocessor": No such file or directory.

                            1 Reply Last reply Reply Quote 0
                            • G
                              Gradius
                              last edited by

                              Checking snort.conf I found:

                              dynamicpreprocessor directory /usr/local/lib/snort_dynamicpreprocessor/
                              dynamicengine /usr/local/lib/snort_dynamicengine/libsf_engine.so
                              dynamicdetection directory /usr/local/lib/snort_dynamicrules

                              However, there is nothing on /usr/local/lib/snort_dynamicpreprocessor (as I listed above).

                              There is NO libsf_engine.so file at all on system!

                              Only /usr/local/lib/snort_dynamicrules exists (as directory only, but there is nothing inside on it too).

                              1 Reply Last reply Reply Quote 0
                              • C
                                Cino
                                last edited by

                                uninstall snort
                                drop down to shell
                                run 'find /* | grep snort'
                                delete every reference
                                install snort
                                update rules
                                Click save on every page, Global page for sure, so the cron job is added
                                make sure every preprocessor is ON

                                that should do it, at least for i386… can't help with amd64 builds... and in the past, amd64 always had problems with snort for some reason

                                1 Reply Last reply Reply Quote 0
                                • G
                                  Gradius
                                  last edited by

                                  I'm getting this now:
                                  Jun 12 16:42:17 php: /status_services.php: The command '/usr/local/etc/rc.d/snort.sh stop' returned exit code '1', the output was 'rm: /tmp/snort.sh.pid: No such file or directory rm: /var/run/snort*: No such file or directory'

                                  I even rebooted, no joy.

                                  1 Reply Last reply Reply Quote 0
                                  • T
                                    taryezveb
                                    last edited by

                                    @Cino:

                                    uninstall snort
                                    drop down to shell
                                    run 'find /* | grep snort'

                                    In case the Snort devs do not know this. Or maybe it is just me?

                                    Code:

                                    Installation of snort FAILED!
                                    delete every reference
                                    install snort
                                    update rules
                                    Click save on every page, Global page for sure, so the cron job is added
                                    make sure every preprocessor is ON

                                    that should do it, at least for i386… can't help with amd64 builds... and in the past, amd64 always had problems with snort for some reason

                                    The above worked for me using a amd64 install. Needed to do this, since the snort rules would not get updated.

                                    Used the following instead of, [find /* | grep snort]:

                                    find /* | grep -i snort | xargs rm -rv

                                    EDIT: Thanks Cino for the info :)

                                    When I finished setting up snort, noticed there was a new version:

                                    Stable	
2.9.2.3 pkg v. 2.2
platform: 2.0

                                    But the new version fails to install:

                                    Installation of snort FAILED!

Beginning package installation for snort...
Downloading package configuration file... done.
Saving updated package information... done.
Downloading snort and its dependencies... 
Checking for package installation... 
 Downloading http://files.pfsense.org/packages/amd64/8/All/barnyard2-1.9_2.tbz ...  could not download from there or http://ftp2.FreeBSD.org/pub/FreeBSD/ports/amd64/packages-8.1-release/All/barnyard2-1.9_2.tbz.
of barnyard2-1.9_2 failed!

Installation aborted.Backing up libraries... 
Removing package...
Starting package deletion for mysql-client-5.1.53...done.
Starting package deletion for barnyard2-1.9_2...done.
Starting package deletion for snort-2.9.2.3...done.
Starting package deletion for perl-threaded-5.12.4_4...done.
Removing snort components...
Menu items... done.
Services... done.
Loading package instructions...
Include file snort.inc could not be found for inclusion.
Deinstall commands... 
Not executing custom deinstall hook because an include is missing.
Removing package instructions...done.
Auxiliary files... done.
Package XML... done.
Configuration... done.
Cleaning up... Failed to install package.

Installation halted.
                                    1 Reply Last reply Reply Quote 0
                                    • C
                                      Cino
                                      last edited by

                                      noticed that too. barnyard2-1.9_2.tbz isnt built yet.. once its built, you should be good to go

                                      1 Reply Last reply Reply Quote 0
                                      • T
                                        taryezveb
                                        last edited by

                                        @Cino:

                                        noticed that too. barnyard2-1.9_2.tbz isnt built yet.. once its built, you should be good to go

                                        Yes, just wanted to report my findings and thanks for conformation. Will try again later and report back :)

                                        1 Reply Last reply Reply Quote 0
                                        • C
                                          Cino
                                          last edited by

                                          @taryezveb:

                                          @Cino:

                                          noticed that too. barnyard2-1.9_2.tbz isnt built yet.. once its built, you should be good to go

                                          Yes, just wanted to report my findings and thanks for conformation. Will try again later and report back :)

                                          it will be located here: http://files.pfsense.org/packages/8/All/ when its built

                                          1 Reply Last reply Reply Quote 0
                                          • T
                                            taryezveb
                                            last edited by

                                            @Cino:

                                            it will be located here: http://files.pfsense.org/packages/8/All/ when its built

                                            Thanks for all the info :)

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.