Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Suricata Starts then STOP - Crash

    Scheduled Pinned Locked Moved IDS/IPS
    16 Posts 2 Posters 5.1k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • G
      gdsnytech
      last edited by

      There is no entry.

      Is it because i have the firewall turned off?

      I am using pfsense for caching and web content filtering only via squid3 and squidguard.

      The pfsense box sits behind a junitper firewall so there was no need to have the firewall on on pfsense as well.

      I am already dealing with bottle neck issues in regards to clamav/icap when they are turned on. The are choking and limiting throughput.

      1 Reply Last reply Reply Quote 0
      • G
        gdsnytech
        last edited by

        @bmeeks:

        EDIT: Did a quick search myself.  It was not a package, it was Limiters in the Traffic Shaper.  Here is a relevant thread from Snort (but it will apply to Suricata as well):  https://forum.pfsense.org/index.php?topic=82268.msg450021#msg450021

        Bill

        Thank you! That seems to have done it.

        1 Reply Last reply Reply Quote 0
        • bmeeksB
          bmeeks
          last edited by

          Glad to help and happy that fixed it for you.

          Bill

          1 Reply Last reply Reply Quote 0
          • G
            gdsnytech
            last edited by

            I notice that i have to re-run the command every time i reboot pfsense.

            pfctl -t snort2c -T add 1.1.1.1

            Is there a way to make it stick? Maybe a cron job?

            1 Reply Last reply Reply Quote 0
            • bmeeksB
              bmeeks
              last edited by

              @gdsnytech:

              I notice that i have to re-run the command every time i reboot pfsense.

              pfctl -t snort2c -T add 1.1.1.1

              Is there a way to make it stick? Maybe a cron job?

              Posted this reply to you in another thread as well.  I think your box may have after effects of a Traffic Shaper bug.  See if the steps in this thread help – https://forum.pfsense.org/index.php?topic=82268.msg450204#msg450204

              Bill

              1 Reply Last reply Reply Quote 0
              • G
                gdsnytech
                last edited by

                Traffic shaper is not enabled.

                1 Reply Last reply Reply Quote 0
                • bmeeksB
                  bmeeks
                  last edited by

                  Was it ever in the past perhaps?  There is something in your pfSense configuration that is preventing the boot up code from creating the <snort2c>table automatically like it is supposed to.  That table is created way before any packages are loaded and started.  Look in /tmp for any PHP errors file and see what's in them.

                  Bill</snort2c>

                  1 Reply Last reply Reply Quote 0
                  • G
                    gdsnytech
                    last edited by

                    No traffic shaper was never touched.

                    Is there a way to edit this code? If so where is it located? Is it in the config file?

                    Below is the only error in the php error log.

                    [06-Aug-2015 05:02:26 EST5EDT] PHP Warning:  Invalid argument supplied for foreach() in /usr/local/pkg/patches.inc on line 159

                    1 Reply Last reply Reply Quote 0
                    • bmeeksB
                      bmeeks
                      last edited by

                      @gdsnytech:

                      No traffic shaper was never touched.

                      Is there a way to edit this code? If so where is it located? Is it in the config file?

                      Below is the only error in the php error log.

                      [06-Aug-2015 05:02:26 EST5EDT] PHP Warning:  Invalid argument supplied for foreach() in /usr/local/pkg/patches.inc on line 159

                      This error has nothing to do with Suricata.  That file is not part Suricata's collection.  Do you have other packages installed that may be trying to include this file?

                      Bill

                      1 Reply Last reply Reply Quote 0
                      • G
                        gdsnytech
                        last edited by

                        Below are the list of the only services that i have installed on pfsense.

                        FYI: i have re-installed pfsense 2.2.4 on a new box and used the restore feature to restore my config on it. Suricata is not even starting now even after running the command.

                        apinger
                        bandwidthd
                        c-icap
                        clamd
                        cron
                        dnsmasq
                        ntopng
                        ntpd
                        squid
                        squidGuard
                        sshd
                        suricata
                        vhosts-http

                        1 Reply Last reply Reply Quote 0
                        • bmeeksB
                          bmeeks
                          last edited by

                          @gdsnytech:

                          Below are the list of the only services that i have installed on pfsense.

                          FYI: i have re-installed pfsense 2.2.4 on a new box and used the restore feature to restore my config on it. Suricata is not even starting now even after running the command.

                          apinger
                          bandwidthd
                          c-icap
                          clamd
                          cron
                          dnsmasq
                          ntopng
                          ntpd
                          squid
                          squidGuard
                          sshd
                          suricata
                          vhosts-http

                          That would indicate one of two things.  First, the configuration itself might be corrupt, so when restored onto a new install it could be killing the new install.  Another possibility is that the new box has different NIC hardware.  That would change the physical interface names Suricata needs in order to function correctly.  For example, if you old box had older Intel NICs using the em0 driver, but now your new box has Realtek NICs using the re0 driver.  The change in physical NIC names will trip up Suricata (and Snort as well).  In that case I would recommend configuring Suricata again from scratch and not importing an old configuration.

                          Bill

                          1 Reply Last reply Reply Quote 0
                          • G
                            gdsnytech
                            last edited by

                            I have since uninstalled it but have not been install it back. The installation never completes. I am able to install it via ssh though but not through the web console.

                            Please see the attached. That is where it get stuck.

                            Any ideas?

                            suricata.png_thumb
                            suricata.png

                            1 Reply Last reply Reply Quote 0
                            • First post
                              Last post
                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.