Snort 2.9.6.2 pkg v3.1.2 Update – Release Notes
-
Hey Adam. I think you need to upgrade. I think Bill posted in a thread about that.
-
I should have looked at all the point releases between and not just the last version. Snort 2.9.6.2 pkg v3.1.1 Update is what left pfsense 2.0.3 behind. Now I need to figure out how to get the previous snort package back on the system. This will be fun. The secondary still has the previous package. I don't know enough about the package system yet to do it though.
EDIT: I am wondering if my best bet is to somehow edit the package gui code to think snort-2.9.6.0.tbz is the latest version.
EDIT2: I assume there is not a way for the developers to mark older package versions as only available for older versions of pfsense. That way 2.0.x would see a different list than 2.1.x.
-
What is holding you to stay with version 2.0.3?
-
I won't have maintenance time until next month (I prefer to be there during an upgrade). My time is needing locally for other projects right now.
I plan to reproduce the site config locally for testing.
Another idea I have is to mirror the package directory…
http://files.pfsense.org/packages/8/All/
to a local site, removing the newest snort package, and finding the url in the gui code to change it my private site.
I am not sure if this will work though as I don't know if there is another file that gets downloaded that lists available packages (which I bet there is). I am trying to make sense of the pkg-utils.inc code.
-
I'm sure you can find a way too hack the installation, but I would wait for Bill to chime in and say that it won't break your box. The last thing you want if you are not local to your box.
-
I won't have maintenance time until next month (I prefer to be there during an upgrade). My time is needing locally for other projects right now.
I plan to reproduce the site config locally for testing.
Another idea I have is to mirror the package directory…
http://files.pfsense.org/packages/8/All/
to a local site, removing the newest snort package, and finding the url in the gui code to change it my private site.
I am not sure if this will work though as I don't know if there is another file that gets downloaded that lists available packages (which I bet there is). I am trying to make sense of the pkg-utils.inc code.
The latest Snort package will not run on 2.0.3 pfSense. This is because it uses some native pfSense functions that are only available in 2.1 and higher.
You could stay with the older Snort version, though. However, installing it will require lots of hacking. In addition to manually installing the *.tbz packages, you will need to carefully hand-edit the config.xml file to simulate actual pacakge installation. After that you would also need to copy the older version of the PHP and INC files to the box in their proper directories. If you have a secondary box still running the older version, you could use it as a source and template to follow. It's all a lot of work and there are multiple points to make critical errors. In my view this is as risky as simply doing a remote upgrade to 2.1.x and then installing the current Snort package.
Bill
-
Hi,
Since this update, I am facing an error :
php: /snort/snort_interfaces.php: The command '/usr/local/bin/snort -R 24394 -D -q -l /var/log/snort/snort_em024394 –pid-path /var/run --nolock-pidfile -G 24394 -c /usr/pbi/snort-i386/etc/snort/snort_24394_em0/snort.conf -i em0' returned exit code '1', the output was ''
snort[43498]: FATAL ERROR: Failed to load /usr/pbi/snort-i386/lib/snort/dynamicrules/file-executable.so: /usr/pbi/snort-i386/lib/snort/dynamicrules/file-executable.so: Shared object has no run-time symbol tableFollowing a post I have tried to de-install / re-install the package… But the error is persistent.
I would like to avoid killing my configuration since It is quite elaborated and complex.
Do you have any idea how to correct this bug without having to delete all created rule set and configuration ?
-
Save settings on deinstall in global settings and then deinstall/reinstall package.
Then it should work
-
Save settings on deinstall in global settings and then deinstall/reinstall package.
Then it should work
It has already been done… and It does not work.
-
Have you rebooted between installations?
-
Have you rebooted between installations?
No - no reboot…
It is a firewall that's in production and rebooting is something I only do upon upgrade.Isn't there any way to avoid this reboot ?
The libraries are linked to the kernel ?
-
Do you run CARP?
If you do then reboot is easy peasy :)
-
no - no CARP !
:'(
-
no - no CARP !
:'(
What installation type is this? Is it a full install on a conventional hard disk, or is it a NanoBSD install on a CF card?
Bill
-
What installation type is this? Is it a full install on a conventional hard disk, or is it a NanoBSD install on a CF card?
It is a nanobsd install.
-
What installation type is this? Is it a full install on a conventional hard disk, or is it a NanoBSD install on a CF card?
It is a nanobsd install.
Try increasing the /tmp partition to 80 MB or even 100 MB. Another user had a similar issue with rule updates and found out his /tmp partition was running out of space. Once the partition is enlarged, try the remove and reinstall step again.
Snort and Suricata really don't play well with NanoBSD because both packages need a lot of disk space and RAM.
Bill
-
Try increasing the /tmp partition to 80 MB or even 100 MB. Another user had a similar issue with rule updates and found out his /tmp partition was running out of space. Once the partition is enlarged, try the remove and reinstall step again.
Snort and Suricata really don't play well with NanoBSD because both packages need a lot of disk space and RAM.
Ok - I will wait a bis since we are planning to upgrade our pfSense to a newer appliance in the coming weeks.
It'll be based on SSD disks… I guess problem should disappear…Thanks very much for your help.
-
Try increasing the /tmp partition to 80 MB or even 100 MB. Another user had a similar issue with rule updates and found out his /tmp partition was running out of space. Once the partition is enlarged, try the remove and reinstall step again.
Snort and Suricata really don't play well with NanoBSD because both packages need a lot of disk space and RAM.
Ok - I will wait a bis since we are planning to upgrade our pfSense to a newer appliance in the coming weeks.
It'll be based on SSD disks… I guess problem should disappear…Thanks very much for your help.
You will be much more satisfied with Snort when you get the SSD setup.
Bill
-
As an update… thanks for the replies guys. I finished the HA cluster upgrade from 2.0.3 to 2.1.5 this morning (everything went perfectly). I definitely didn't want to customize the installation by trying to get snort to work on 2.0.3.
