Snort no longer working after 2.3.3 Upgrade



  • I thought I would add a topic for this as well because I feel like it might apply to other packages that were once working in an earlier version pfsense.

    As of upgrading to Pfsense version 2.3.3, I was unable to upgrade my snort package as well, kept get an error that the specified directory could not be found.

    I uninstalled snort all together and just installed the newest snort version from scratch.

    The package installs; however, it doesn't turn up under my Services tab and does not show up as a running service in my dashboard like it once did.

    Package is installed but not running or accessible.



  • I saw this in the logs after the update:

    /etc/rc.packages: [Snort] Removing all blocked hosts from <snort2c>table…
    /etc/rc.packages: [Snort] Removing package files…
    /etc/rc.packages: [Snort] Not saving settings… all Snort configuration info and logs will be deleted...
    /etc/rc.packages: [Snort] Flushing <snort2c>firewall table to remove addresses blocked by Snort…
    /etc/rc.packages: [Snort] The package has been completely removed from this system.</snort2c></snort2c>

    Snort showed up in Installed packages with "newer version available". Tried to update:

    Removing snort components…
    Menu items... done.
    Services... done.
    Loading package instructions...
    pfSense-pkg-snort-3.2.9.1_14: missing file /usr/local/share/licenses/pfSense-pkg-snort-3.2.9.1_14/ESF
    pfSense-pkg-snort-3.2.9.1_14: missing file /usr/local/share/licenses/pfSense-pkg-snort-3.2.9.1_14/LICENSE
    pfSense-pkg-snort-3.2.9.1_14: missing file /usr/local/share/licenses/pfSense-pkg-snort-3.2.9.1_14/catalog.mk
    pkg: Fail to rename /var/db/snort/sidmods/.disablesid-sample.conf.xmxAXuJE48b4 -> /var/db/snort/sidmods/disablesid-sample.conf: No such file or directory
    Failed

    Removed package. It threw some errors (attached). Rebooted.

    Installed snort again without a problem. It now shows up in services and my settings are there too.

    Have you tried turning it off and on again?

    [snort package removal error.txt](/public/imported_attachments/1/snort package removal error.txt)