Snort 2.9.2.3 pkg v. 2.5.1 service fails overnight, unable to restart

blundar

Services… System logs.

caustic386

@blundar:

Services… System logs.

Unfortunately it only displays the last 50 events, which doesn't take me back to the overnight failure.

Fesoj

blundar,

the sdf problem is known for quite a while and if you search backwards in this thread you'll find a way of handling it.

blundar

you can change the number of lines using the settings tab. I have mine set to 500.

caustic386

@blundar:

you can change the number of lines using the settings tab. I have mine set to 500.

Thanks - can't believe I never noticed that. I'll check it again first thing in the AM.

Cino

dumb question, is everyone seeing updated rules? Since Sunday, i've had the same hash:

SNORT.ORG >>> "7017498f85ec6d0fc34c904c950ed8c1"
EMERGINGTHREATS.NET >>> 13611f17ed1c94d40c8f0a78566dbb90

I've been deleting the hash to force a manual update.. The auto update kicks off but nothing is downloaded since there isn't a new hash

caustic386

@Cino:

dumb question, are is everyone seeing updated rules? Since Sunday, i've had the same hash:

SNORT.ORG >>> "7017498f85ec6d0fc34c904c950ed8c1"
EMERGINGTHREATS.NET >>> 13611f17ed1c94d40c8f0a78566dbb90

I've been deleting the hash to force a manual update.. The auto update kicks off but nothing is downloaded since there isn't a new hash

Sunday-Monday was the only day snort did not fail during updates, so it's possible there just weren't any that night. I can't account for Monday, however.

judex

You can check the actual MD5 Hash of "Only Registered Users" here:

http://www.snort.org/downloads/1778/show_md5

It is still:
"7017498f85ec6d0fc34c904c950ed8c1"

I am also checking that, because I also suspect snort to only update ET rules automatically. Manual updates work so far.

Greets, Judex

Cino

auto update finally kicked for snort for me… 2 test boxes fresh installs of pfsense and snort...

box with using snort and et with sensitive data preprocessor enabled: failed to reload, the usually error everyone is seeing
box with using snort and et with sensitive data preprocessor disabled: reloaded fine

IMHO, I feel the sensitive preprocessor option should be removed from snort until a working fix can be applied to the package. or a warning that auto updates should be disabled and and to run updates manually

caustic386

Finally getting back to the original post, I think this is what's causing the issue:

kernel: pid 31475 (snort), uid 0, was killed: out of swap space

As a test, I disabled updates. As expected, snort ran fine until I did a manual update. The error above was what showed up after running the update. Restarting snort by hand brought success.

Is the swap space error helpful? I do not have a swap partition on my install, as I have significant excess RAM.