Snort failing to restart after rules update - manual restart works fine

paddyboyfloyd

Running Snort 3.2.9.1_14 on pfSense 2.3.2. 3-4 times a week when SNORT updates the rules overnight, the two interfaces fail to restart. System logs do not show any attempt to restart the interfaces. When I log in, I can manually start the interfaces with out issue. I don't see any log in the System log that a start was generated on the interface. Only items in System log from last night:
Oct 31 00:05:15 php /usr/local/pkg/snort/snort_check_for_rule_updates.php: [Snort] Snort VRT rules are up to date…
Oct 31 00:05:18 php /usr/local/pkg/snort/snort_check_for_rule_updates.php: [Snort] Snort GPLv2 Community Rules are up to date…
Oct 31 00:05:18 php /usr/local/pkg/snort/snort_check_for_rule_updates.php: [Snort] Emerging Threats Open rules are up to date…
Oct 31 00:05:18 php /usr/local/pkg/snort/snort_check_for_rule_updates.php: [Snort] The Rules update has finished.
Oct 31 00:05:18 check_reload_status Syncing firewall
But when I manually started interface, no issue:
Oct 31 09:48:42 php-fpm 96951 /index.php: Successful login for user 'admin' from: 192.168.1.103
Oct 31 09:49:00 php-fpm 9467 /snort/snort_interfaces.php: [Snort] Updating rules configuration for: LAN …
Oct 31 09:49:17 php-fpm 9467 /snort/snort_interfaces.php: [Snort] Enabling any flowbit-required rules for: LAN…
Oct 31 09:49:19 php-fpm 9467 /snort/snort_interfaces.php: [Snort] Building new sid-msg.map file for LAN…
Oct 31 09:49:26 php-fpm 9467 /snort/snort_interfaces.php: [Snort] Updating rules configuration for: WAN …
Oct 31 09:49:43 php-fpm 9467 /snort/snort_interfaces.php: [Snort] Enabling any flowbit-required rules for: WAN…
Oct 31 09:49:45 php-fpm 9467 /snort/snort_interfaces.php: [Snort] Building new sid-msg.map file for WAN…
Oct 31 09:49:52 php-fpm 9467 /snort/snort_interfaces.php: Starting Snort on LAN(em2) per user request...
Oct 31 09:49:52 php-fpm 9467 /snort/snort_interfaces.php: [Snort] Snort START for LAN(em2)…
Oct 31 09:51:48 kernel em2: promiscuous mode enabled

Any idea as to why SNORT is not starting or attempting to start the interface after the update?

benofishal

I am also having this problem. Anyone with any light to shed?

u3c307

is your memory setting set to AC-BNFA-NQ?

paddyboyfloyd

Currently algorithm is set to AC-BNFA. I tried to run it on ACS, but it basically maxed out the RAM and made the interface very unusable. It's running on a 2.3.2 on a Quad core celeron with 4GB RAM.