I broke the Snort widget

KOM · Feb 20, 2015, 9:18 PM

I made the mistake of clicking Save with the # of recent alerts box empty. Now the Snort widget only shows one entry, it doesn't ever update and it doesn't show its config button. I tried poking around the widget section of the www folder but I can't figure it out. Help!

KOM · Feb 20, 2015, 8:59 PM

OK, fixed it. I found the config file in /conf. A quick glance showed a badly-formatted XML entry:

 <widgets><widget_snort_display_lines></widget_snort_display_lines></widgets>

I changed it to:

 <widgets><widget_snort_display_lines>5</widget_snort_display_lines></widgets>

Save, reboot and all is good again.

phil.davis · Feb 21, 2015, 2:02 PM

Yeh, pressing Save with blank input breaks it for me also. The widget gets itself in trouble then trying to display the last "blank" number of snort alerts. It does not get far enough to switch the little "tool" icon on, so you do not get a chance to do the setting again.
This pull request should fix it: https://github.com/pfsense/pfsense-packages/pull/826

bmeeks · Feb 23, 2015, 10:37 PM

The fix for this (provided by Phil, thanks ;)) was merged into production today. The package version was NOT bumped because the change was so minor and really did not impact Snort itself. If you want the fix, simply do a GUI Components reinstall of Snort using the XML icon on the System > Packages > Installed Packages tab.

Bill