Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Snort fails to start after upgrade from 2.3.4 to 2.3.4_p1

    Scheduled Pinned Locked Moved Problems Installing or Upgrading pfSense Software
    6 Posts 2 Posters 941 Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • ?
      A Former User
      last edited by

      We upgraded 7 firewalls to 2.3.4_p1.
      After upgrade on 6 units snort isn't working with new pfsense release.

      Here is system log message from 2:

      Aug 16 07:31:41SnortStartup37526Snort START for WAN_ATT(58471_igb1)…
      Aug 16 07:31:41snort38350FATAL ERROR: /usr/local/etc/snort/snort_58471_igb1/rules/snort.rules(389) Unknown ClassType: sdf

      Aug 16 07:52:42snort65105FATAL ERROR: /usr/local/etc/snort/snort_58471_igb5/rules/snort.rules(389) Unknown ClassType: sdf
      Aug 16 07:52:42SnortStartup63737Snort START for WAN_ATT(58471_igb5)...

      I'm sure someone already faced it before.
      Thank you in advance.

      1 Reply Last reply Reply Quote 0
      • bmeeksB
        bmeeks
        last edited by

        You have sensitive data rules enabled in your rule set but the sensitive data preprocessor (sdf) is disabled.  Either disable the SDF rules or go to the PREPROCESSORS tab for the interface and check the box to enable the Sensitive Data preprocessor.

        This is most likely caused by the particular set of rules categories you have enabled.

        Bill

        1 Reply Last reply Reply Quote 0
        • ?
          A Former User
          last edited by

          Based on my colleague and I will quote him:

          "there is a bug
          it inserts this rule
          alert ( msg: "SDF_COMBO_ALERT"; sid: 1; gid: 139; rev: 1; metadata: rule-type preproc ; classtype:sdf; )
          even when off"

          1 Reply Last reply Reply Quote 0
          • ?
            A Former User
            last edited by

            [2.3.4-RELEASE][root@FW.corp]/root: vi /usr/local/etc/snort/snort_58471_igb1/preproc_rules/preprocessor.rules

            or

            /usr/local/etc/snort/preproc_rules/preprocessor.rules:alert ( msg: "SDF_COMBO_ALERT"; sid: 1; gid: 139; rev: 1; metadata: rule-type preproc ; classtype:sdf; )

            Removing the line is a quick fix, but will it come back after next upgrade .. we don't know

            1 Reply Last reply Reply Quote 0
            • bmeeksB
              bmeeks
              last edited by

              @Rajko:

              Based on my colleague and I will quote him:

              "there is a bug
              it inserts this rule
              alert ( msg: "SDF_COMBO_ALERT"; sid: 1; gid: 139; rev: 1; metadata: rule-type preproc ; classtype:sdf; )
              even when off"

              The Snort package itself generates no rules nor inserts any rules arbitrarily.  I will need to review the package installation code to see if anything happens during installation (or re-installation) that could affect this.

              Does this happen even when you "upgrade" by first removing the package entirely and then re-installing?  There can be some potential issues with a re-installation over an existing one when upgrading.  My recommendation is always remove the package and then reinsall it.  That takes only a couple of extra clicks and an additional 30 seconds or so.

              Bill

              1 Reply Last reply Reply Quote 0
              • ?
                A Former User
                last edited by

                We did not try removing package prior to upgrade.

                Thank you for checking scripts.

                1 Reply Last reply Reply Quote 0
                • First post
                  Last post
                Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.