Snort fatal error on start
-
Turns out /usr/pbi/snort-amd64/etc/snort/snort_61603_re1/snort.conf had already reverted to:
# HTTP Inspect # preprocessor http_inspect: global \ iis_unicode_map unicode.map 1252 \I couldn't find that section in /usr/local/pkg/snort/snort_conf_template.inc so I'm not sure where it's being pulled in from.
I still don't understand why it's using 1252 and apparently the unicode file replacement was the issue rather than the code page # used?
Is a puzzlement. ???
-
Turns out /usr/pbi/snort-amd64/etc/snort/snort_61603_re1/snort.conf had already reverted to:
# HTTP Inspect # preprocessor http_inspect: global \ iis_unicode_map unicode.map 1252 \I couldn't find that section in /usr/local/pkg/snort/snort_conf_template.inc so I'm not sure where it's being pulled in from.
I still don't understand why it's using 1252 and apparently the unicode file replacement was the issue rather than the code page # used?
Is a puzzlement. ???
grep -n "iis_unicode_map" /usr/local/pkg/snort/*
snort_generate_conf.php:1229:$http_inspect_global .= "\\n\tiis_unicode_map unicode.map 1252 \\n";
Its on line 1229 of that file
-
Ah, it's obvious after you explain it, thanks! 8)
In any case it looks like the the sole issue was the corrupted unicode.map file. I have no idea how that could have happened. I presume someone's checked the one in the package?
-
Ah, it's obvious after you explain it, thanks! 8)
In any case it looks like the the sole issue was the corrupted unicode.map file. I have no idea how that could have happened. I presume someone's checked the one in the package?
My mistake on where the edit was. I was working from obviously faulty memory instead of actually looking it up. I forgot that the HTTP preprocessor configuration is built into a single large string variable that is then written to the conf file. Thanks BBcan177 for setting the OP on the right path.
I've done a number of fresh installs and upgrades on 2.1.x and 2.2-ALPHA pfSense virtual machines (along with my own production firewall) and never encountered this problem.
Bill
-
The hardware is a Netgate APU2 http://store.netgate.com/NetgateAPU2.aspx, the same as the VK-T40E in the pfSense store with 2GB RAM and an 8GB SD card. I know that's considered a little light for snort, but I've never seen any issues before. Could a resource exhaustion issue messed with install without leaving any log entries I've spotted?
-
The hardware is a Netgate APU2 http://store.netgate.com/NetgateAPU2.aspx, the same as the VK-T40E in the pfSense store with 2GB RAM and an 8GB SD card. I know that's considered a little light for snort, but I've never seen any issues before. Could a resource exhaustion issue messed with install without leaving any log entries I've spotted?
No, I doubt that low memory would corrupt the file. If you have a Netgate support contract, contact them and tell them about this issue with the corrupted file. There was a similar problem a few weeks back caused by some kind of failure between two servers at ESF/Netgate. It might be messed up again, or it could have just been a temporary glitch.
Bill
-
Check for the file here:
/usr/pbi/snort-amd64/etc/snort
It should be there. If you see it, remount your filesystem in read/write mode and copy the unicode.map file to the subdirectory snort_61603_re1
I have not had a chance yet to upgrade any of my test VMs to 2.1.5, so I have not tried a Snort update with the latest pfSense security fix.
Bill
Hi,
I have the file but it is empty. What can I do?
[2.1.5-RELEASE][admin@firewall]/root(1): find / -type f -name unicode.map | xargs ls -l
-rw-r–r-- 1 root wheel 0 Sep 12 00:09 /usr/pbi/snort-i386/etc/snort/snort_23326_rl0/unicode.map
-rw-r--r-- 1 root wheel 0 Sep 12 00:08 /usr/pbi/snort-i386/etc/snort/snort_43270_rl1/unicode.map
-r--r--r-- 1 root wheel 0 Sep 12 00:07 /usr/pbi/snort-i386/etc/snort/unicode.mapThanks,
Stenio -
Check for the file here:
/usr/pbi/snort-amd64/etc/snort
It should be there. If you see it, remount your filesystem in read/write mode and copy the unicode.map file to the subdirectory snort_61603_re1
I have not had a chance yet to upgrade any of my test VMs to 2.1.5, so I have not tried a Snort update with the latest pfSense security fix.
Bill
Hi,
I have the file but it is empty. What can I do?
[2.1.5-RELEASE][admin@firewall]/root(1): find / -type f -name unicode.map | xargs ls -l
-rw-r–r-- 1 root wheel 0 Sep 12 00:09 /usr/pbi/snort-i386/etc/snort/snort_23326_rl0/unicode.map
-rw-r--r-- 1 root wheel 0 Sep 12 00:08 /usr/pbi/snort-i386/etc/snort/snort_43270_rl1/unicode.map
-r--r--r-- 1 root wheel 0 Sep 12 00:07 /usr/pbi/snort-i386/etc/snort/unicode.mapThanks,
StenioGo to this post my Supermule and copy and paste the contents of his unicode.map file that he generously posted into yours.
https://forum.pfsense.org/index.php?topic=81067.msg442689#msg442689
If removing and reinstalling the package is not bringing you an updated file (one that is not zero-length), then the above copy-paste is the next best option.
Bill
-
Go to this post my Supermule and copy and paste the contents of his unicode.map file that he generously posted into yours.
https://forum.pfsense.org/index.php?topic=81067.msg442689#msg442689
If removing and reinstalling the package is not bringing you an updated file (one that is not zero-length), then the above copy-paste is the next best option.
Bill
Thank you Bill, it works.
-
Go to this post my Supermule and copy and paste the contents of his unicode.map file that he generously posted into yours.
https://forum.pfsense.org/index.php?topic=81067.msg442689#msg442689
If removing and reinstalling the package is not bringing you an updated file (one that is not zero-length), then the above copy-paste is the next best option.
Bill
Thank you Bill, it works.
Glad it worked for you. BTW, I meant to type "by" instead of "my" in the reply up above… :-[
-
It happens every time now the rules get updated. After every update the unicode.map file is blank again. Found no solution so snort is nearly useless now.
-
I'm now having the same problem. For grins and giggles trying:
Backup
De-Install snort
Backup
reinstall pfsenseAnd then we'll see if a reinstall of snort fixes the issue.
-
It happens every time now the rules get updated. After every update the unicode.map file is blank again. Found no solution so snort is nearly useless now.
I have not noticed the problem on my box, but I use both the Snort VRT rules and the Emerging Threats Open rules.
You want to make sure a good master copy of that file resides in the main Snort directory here:
/usr/pbi/snort-{arch}/etc/snort
where {arch} is either i386 or amd-64.
Also, just to help troubleshoot, enable the ET-OPEN rules on the GLOBAL SETTINGS tab and do a manual update (click the UPDATE button on the UPDATES tab). You don't have to actually enable any of the ET-OPEN rules, but I just want to see if they will provide a good copy of the missing unicode.map file.
Bill
-
Hi,
Suddenly every time I start snort I get the following error: :'(
FATAL ERROR: Failed to load /usr/pbi/snort-i386/lib/snort/dynamicrules/protocol-dns.so: /usr/pbi/snort-i386/lib/snort/dynamicrules/protocol-dns.so: invalid file format
I think that the problem is related to the upgrade from 2.1.4 to 2.1.5.
Do you have any ideas?
Thanks,
Stenio -
Hi,
Suddenly every time I start snort I get the following error: :'(
FATAL ERROR: Failed to load /usr/pbi/snort-i386/lib/snort/dynamicrules/protocol-dns.so: /usr/pbi/snort-i386/lib/snort/dynamicrules/protocol-dns.so: invalid file format
I think that the problem is related to the upgrade from 2.1.4 to 2.1.5.
Do you have any ideas?
Thanks,
StenioMy guess is that during the automatic package removal and re-install operation that occurs during a pfSense upgrade, one or more of the Snort binary files in the PBI got corrupted upon the re-install. The file it is complaining about is one of the binary shared-object rule files. It is true this file is updated with each rules update as well, so it may have gotten corrupted then.
Try these steps:
First, force a total new download of Snort rules by going to the UPDATES tab and clicking the FORCE button.
If that does not fix it, (it really should, though), then try removing and re-installing the Snort package. This step really should not be necessary, though.
Bill
-
It happens every time now the rules get updated. After every update the unicode.map file is blank again. Found no solution so snort is nearly useless now.
I did a complete reinstall of pfsense and snort. I can't even start snort the first time… all i get is the FATAL ERROR.
Something seems really f***** up with Netgate APU & pfsense 2.1.5 & snort. I never had any problems before pfsense 2.1.5. Even on the older Netgate m1n1wall i had no problems for years.
So if a fresh install didn't fix the issue then it's really f***** up somewhere.
-
It happens every time now the rules get updated. After every update the unicode.map file is blank again. Found no solution so snort is nearly useless now.
I did a complete reinstall of pfsense and snort. I can't even start snort the first time… all i get is the FATAL ERROR.
Something seems really f***** up with Netgate APU & pfsense 2.1.5 & snort. I never had any problems before pfsense 2.1.5. Even on the older Netgate m1n1wall i had no problems for years.
So if a fresh install didn't fix the issue then it's really f***** up somewhere.
I will pass this along to the Netgate guys. One time in the past there was a temporary issue similar to this. Perhaps it has occurred again. BTW, if you have a support contract with Netgate, you could certainly contact them about your issue. That may be faster than my e-mail to them.
Bill
-
I suffer the same problem. In an attempt to resolve this I uninstall and then try to reinstall snort but it does not reinstall:
Installation of snort FAILED!
Beginning package installation for snort .
Downloading package configuration file… done.
Saving updated package information... done.
Downloading snort and its dependencies...
Checking for package installation...
Downloading https://files.pfsense.org/packages/8/All/snort-2.9.6.2-i386.pbi ... (extracting)
Loading package configuration... done.
Configuring package components...
Additional files... snort_sync.xml failed.
Removing package...
Starting package deletion for snort-2.9.6.2-i386...done.
Removing snort components...
Menu items... done.
Services... done.
Loading package instructions...
Deinstall commands... done.
Removing package instructions...done.
Auxiliary files... done.
Package XML... done.
Configuration... done.
done.
Failed to install package.Installation halted.
Is there any solution yet?
-
2nd reinstall attempt no longer failed, but the original error persists:
Sep 17 16:49:51 php: /snort/snort_interfaces.php: The command '/usr/local/bin/snort -R 12306 -D -q -l /var/log/snort/snort_em1_vlan112306 –pid-path /var/run --nolock-pidfile -G 12306 -c /usr/pbi/snort-i386/etc/snort/snort_12306_em1_vlan1/snort.conf -i em1_vlan1' returned exit code '1', the output was ''
Sep 17 16:49:51 snort[30106]: FATAL ERROR: /usr/pbi/snort-i386/etc/snort/snort_12306_em1_vlan1/snort.conf(169) => Did not find specified IIS Unicode codemap in the specified IIS Unicode Map file.
Version 2.1.5-RELEASE (i386)
built on Mon Aug 25 07:44:26 EDT 2014
FreeBSD 8.3-RELEASE-p16CPU Type Intel(R) Atom(TM) CPU D410 @ 1.66GHz
Current: 207 MHz, Max: 1659 MHzMemory usage 10% of 2011 MB
Disk usage 31% of 1.8G
-
It happens every time now the rules get updated. After every update the unicode.map file is blank again. Found no solution so snort is nearly useless now.
I did a complete reinstall of pfsense and snort. I can't even start snort the first time… all i get is the FATAL ERROR.
Something seems really f***** up with Netgate APU & pfsense 2.1.5 & snort. I never had any problems before pfsense 2.1.5. Even on the older Netgate m1n1wall i had no problems for years.
So if a fresh install didn't fix the issue then it's really f***** up somewhere.
I will pass this along to the Netgate guys. One time in the past there was a temporary issue similar to this. Perhaps it has occurred again. BTW, if you have a support contract with Netgate, you could certainly contact them about your issue. That may be faster than my e-mail to them.
Bill
Yes i have a support contract with Netgate. I thought that this is related to just a package so they can't help anyway. But it seems that only Netgate APUs are affected so i contacted the support about the issue.
I will post the answer here is they are aware of it. Let me know what they told you.
