Snort crashes on update

foresthus · Aug 28, 2015, 5:36 PM

Hello,

I have a problem when I updated to the new SNORT. This is the failure:

Crash report begins. Anonymous machine information:

amd64
10.1-RELEASE-p15
FreeBSD 10.1-RELEASE-p15 #0 c5ab052(releng/10.1)-dirty: Sat Jul 25 20:20:58 CDT 2015 root@pfs22-amd64-builder:/usr/obj.amd64/usr/pfSensesrc/src/sys/pfSense_SMP.10

Crash report details:

PHP Errors:
[28-Aug-2015 14:09:21 Europe/Berlin] PHP Fatal error:  require(): Failed opening required '/usr/local/pkg/snort/snort_defs.inc' (include_path='.:/etc/inc:/usr/local/www:/usr/local/captiveportal:/usr/local/pkg') in /usr/local/pkg/snort/snort.inc on line 40
[28-Aug-2015 14:15:26 Europe/Berlin] PHP Fatal error:  require(): Failed opening required '/usr/local/pkg/snort/snort_defs.inc' (include_path='.:/etc/inc:/usr/local/www:/usr/local/captiveportal:/usr/local/pkg') in /usr/local/pkg/snort/snort.inc on line 40

Filename: /var/crash/minfree
2048

What can I do?

doktornotor · Aug 28, 2015, 5:37 PM

Reinstall the package again so that the required file is not missing?

bmeeks · Aug 29, 2015, 3:19 AM

The @dok is correct. You have one or more missing files in your Snort installation. Try going to System…Packages and click the XML icon on the Installed Packages tab beside Snort to re-install the GUI package components for Snort.

Post back if the issue continues.

Bill

foresthus · Aug 30, 2015, 4:44 PM

@bmeeks:

The @dok is correct. You have one or more missing files in your Snort installation. Try going to System…Packages and click the XML icon on the Installed Packages tab beside Snort to re-install the GUI package components for Snort.

Post back if the issue continues.

Bill

No is did not work. So I decided to restore one o fmy backups befor the update came. That helped, bur reinstall or just reinstall the GUI package did not help.

After the restore everything was ok again. I was able to send the crashreport, what I did.

cu

hulleyrob · Aug 30, 2015, 6:27 PM

I had something similar on the last update wouldn't start then wouldn't remove or reinstall.

Reinstall guy followed by reinstall worked for me but it does look like the last update has caused a few problems.

Rob

themaninspain · Sep 4, 2015, 4:37 PM

Well I've got it again today this time it's a different module:

snort[68706]: FATAL ERROR: Failed to load /usr/pbi/snort-amd64/lib/snort_dynamicrules/pua-p2p.so: /usr/pbi/snort-amd64/local/lib/snort_dynamicrules/pua-p2p.so: invalid file format
Which is interesting because I don't have this ruleset activated.

and

snort[14720]: FATAL ERROR: Failed to load /usr/pbi/snort-amd64/lib/snort_dynamicrules/protocol-voip.so: /usr/pbi/snort-amd64/local/lib/snort_dynamicrules/protocol-voip.so: Shared object has no run-time symbol table

no idea on this one.

Any ideas on what's going on? I can't believe that snort rule updates are this flaky so there must be another problem causing this.

Alan

doktornotor · Sep 4, 2015, 5:16 PM

Perhaps you should just stop updating the rules until upstream guys come back to senses. Already reported by someone else as well with different .so - see https://forum.pfsense.org/index.php?topic=98920.0