Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Snort 2.9.2.3 pkg v. 2.5.0 Issues

    Scheduled Pinned Locked Moved pfSense Packages
    331 Posts 38 Posters 226.5k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • K
      kilthro
      last edited by

      I dont see this in the system log. When I go to the updated tab in snort the view updates log button doesnt do anything when clicked. I did a manual update and did see this in the sys log
      Jan 27 11:49:12 php: /snort/snort_download_rules.php: The Rules update has finished…
      Jan 27 11:49:12 php: /snort/snort_download_rules.php: Emerging threat rules are up to date...
      Jan 27 11:49:12 php: /snort/snort_download_rules.php: Snort rules are up to date...
      So i am guessing if the auto update ran I should see something similar? I do not see anything like this around midnight when the update generally runs.

      1 Reply Last reply Reply Quote 0
      • A
        asterix
        last edited by

        Having issues with the latest snort package as well. Initial update killed the package. Uninstalled, did a reboot and reinstalled to make it work. But now the problem is with every reboot snort fails again. As long as its up after reinstall it works. Upon a reboot snort fails and only way to make it work is to uninstall, reboot and reinstall… till the next reboot.

        1 Reply Last reply Reply Quote 0
        • S
          Supermule Banned
          last edited by

          Dont get that error on reboot, but still a shit load of Snort related load messages in the systemlogs….

          1 Reply Last reply Reply Quote 0
          • E
            eri--
            last edited by

            You need to reinstall supermule or you have issues.
            It will only print fatal/errors as i said now. Those things need some attention.

            asterix
            i need mor einfo rather than not just starting!

            1 Reply Last reply Reply Quote 0
            • S
              Supermule Banned
              last edited by

              Its running fine here Ermal and survives the reboot.

              Wont reinstall if it makes snort crash…

              1 Reply Last reply Reply Quote 0
              • A
                asterix
                last edited by

                Get this on startup. Service re-start fails.

                Jan 27 13:47:05 SnortStartup[59927]: Snort START For WAN(52490_em0)…
                Jan 27 13:47:05 SnortStartup[59542]: Snort SOFT START For WAN(52490_em0)…
                Jan 27 13:47:03 php: : The command '/usr/local/etc/rc.d/snort.sh stop' returned exit code '1', the output was ''
                Jan 27 13:47:03 php: : The command '/usr/local/etc/rc.d/snort.sh stop' returned exit code '1', the output was ''
                Jan 27 13:47:01 SnortStartup[47342]: Snort STOP For WAN(52490_em0)…

                On manual start it fails with these messages in the system logs

                Jan 27 13:48:38 php: /snort/snort_interfaces.php: Interface Rule START for WAN(em0)...
                Jan 27 13:48:35 php: /snort/snort_interfaces.php: Resolving and auto-enabling flowbit required rules for WAN...
                Jan 27 13:48:34 php: /snort/snort_interfaces.php: Toggle(snort starting) for WAN(WAN)...

                1 Reply Last reply Reply Quote 0
                • E
                  eri--
                  last edited by

                  There is no failure there.
                  The error messages there are just too much noise.

                  1 Reply Last reply Reply Quote 0
                  • A
                    asterix
                    last edited by

                    Well I dont see any other logs in there.. It just fails to start. I am on a VM but that shouldnt be a an issue. Been using a VM for many months with no such issues.

                    1 Reply Last reply Reply Quote 0
                    • M
                      monodactylus
                      last edited by

                      Assuming this is the proper way to start snort from the prompt, you would see the following error:

                      /usr/local/etc/rc.d/snort.sh start
                      pgrep: Pidfile `/var/run/snort_vr152213.pid' is empty
                      /libexec/ld-elf.so.1: Shared object "libmysqlclient.so.18" not found, required by "snort"

                      @asterix:

                      Get this on startup. Service re-start fails.

                      Jan 27 13:47:05 SnortStartup[59927]: Snort START For WAN(52490_em0)…
                      Jan 27 13:47:05 SnortStartup[59542]: Snort SOFT START For WAN(52490_em0)…
                      Jan 27 13:47:03 php: : The command '/usr/local/etc/rc.d/snort.sh stop' returned exit code '1', the output was ''
                      Jan 27 13:47:03 php: : The command '/usr/local/etc/rc.d/snort.sh stop' returned exit code '1', the output was ''
                      Jan 27 13:47:01 SnortStartup[47342]: Snort STOP For WAN(52490_em0)…

                      On manual start it fails with these messages in the system logs

                      Jan 27 13:48:38 php: /snort/snort_interfaces.php: Interface Rule START for WAN(em0)...
                      Jan 27 13:48:35 php: /snort/snort_interfaces.php: Resolving and auto-enabling flowbit required rules for WAN...
                      Jan 27 13:48:34 php: /snort/snort_interfaces.php: Toggle(snort starting) for WAN(WAN)...

                      1 Reply Last reply Reply Quote 0
                      • A
                        asterix
                        last edited by

                        Snort needs to be started automatically when pfSense boots. Even so the GUI service start should throw some errors.

                        The latest package definitely needs a fix.

                        1 Reply Last reply Reply Quote 0
                        • E
                          eri--
                          last edited by

                          Hrm that is a problem with the building of the package.
                          barnyard2 requires mysql but snort does not require it.

                          Will see to get it fixed. For now just install this mysql-client-5.1.53.tbz
                          i386

                          
pkg_add -v http://files.pfsense.org/packages/8/All/mysql-client-5.1.53.tbz

                          AMD64

                          
http://files.pfsense.org/packages/amd64/8/All/mysql-client-5.1.53.tbz

                          For 2.1 PBI should include that

                          1 Reply Last reply Reply Quote 0
                          • S
                            Supermule Banned
                            last edited by

                            I run mine in VM too…. So it shouldnt be a problem.

                            1 Reply Last reply Reply Quote 0
                            • L
                              LiamH
                              last edited by

                              Hi,

                              The uninstall/install after reboot happens on my machine as well, with the same errors…

                              Another thing - I don't think HOME_NET is being populated correctly on my machine. On my LAN interface, instead of including my network it only includes pfSense IP (and my external IPs, DNS, etc) . I've ended up editing snort.inc and manually adding my network address but I guess this will hold only until next reboot and reinstall. Older posts mentioned the possibility if using the firewall aliases, but I can only choose "default" at the "Home net" dropdown list.

                              1 Reply Last reply Reply Quote 0
                              • E
                                eri--
                                last edited by

                                You have to create a whitelist to override.
                                If you run snort on the LAN interface then there is no reason to trust your hosts, no?

                                1 Reply Last reply Reply Quote 0
                                • F
                                  fragged
                                  last edited by

                                  Is this a bug or intentional feature / behavior that Snort doesn't download new rules after a uninstall / install (pfSense snapshot update)? I need to go and download the rules which will then start Snort when finished. Shouldn't this happen during the first start?

                                  I'm fairly sure it ran just fine after a snapshot update before the latest changes. Today I updated from 24th January snapshot to:

                                  2.1-BETA1 (amd64)
                                  built on Sun Jan 27 20:37:59 EST 2013

                                  1 Reply Last reply Reply Quote 0
                                  • E
                                    eri--
                                    last edited by

                                    I put a fix on new pacakge to reapply the update during reinstall if the keep settings is on.
                                    Normally your rules should be preserved during a reinstall but….

                                    1 Reply Last reply Reply Quote 0
                                    • RonpfSR
                                      RonpfS
                                      last edited by

                                      Is there a limit on the number of download of the snort rules per hour?

                                      2.4.5-RELEASE-p1 (amd64)
                                      Intel Core2 Quad CPU Q8400 @ 2.66GHz 8GB
                                      Backup 0.5_5, Bandwidthd 0.7.4_4, Cron 0.3.7_5, pfBlockerNG-devel 3.0.0_16, Status_Traffic_Totals 2.3.1_1, System_Patches 1.2_5

                                      1 Reply Last reply Reply Quote 0
                                      • S
                                        Supermule Banned
                                        last edited by

                                        Yes :)

                                        1 Reply Last reply Reply Quote 0
                                        • S
                                          spi
                                          last edited by

                                          Hej ermal

                                          Thanks for all your valuable knowledge and help here on snort.

                                          Since libmysqlclient.so.18 file is missing after a reboot and not libmysqlclient.so.16

                                          may I ask why it would not be more appropriate to apply```
                                          pkg_add -v http://files.pfsense.org/packages/amd64/8/All/mysql-client-5.5.29.tbz

                                          
this will give version 18 and not 16 as version 5.1.53 would do…or does it not matter ?

@ermal:

> Hrm that is a problem with the building of the package.
> barnyard2 requires mysql but snort does not require it.
> 
> Will see to get it fixed. For now just install this mysql-client-5.1.53.tbz
> i386
> ```
> 
> pkg_add -v http://files.pfsense.org/packages/8/All/mysql-client-5.1.53.tbz
> 
> ```
> 
> AMD64
> ```
> 
> http://files.pfsense.org/packages/amd64/8/All/mysql-client-5.1.53.tbz
> 
> ```
> 
> For 2.1 PBI should include that
                                          1 Reply Last reply Reply Quote 0
                                          • K
                                            kilthro
                                            last edited by

                                            @RonpfS:

                                            Is there a limit on the number of download of the snort rules per hour?

                                            once per 15 minutes is what it has told me in the past.

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.