Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Snort not starting?

    Scheduled Pinned Locked Moved IDS/IPS
    3 Posts 2 Posters 297 Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • x2rlX
      x2rl
      last edited by x2rl

      How can i find out why its not starting?

      Edit = found out

      Aug 14 21:02:04	php		/tmp/snort_em037606_startcmd.php: [Snort] Updating rules configuration for: WAN ...
      Aug 14 21:02:06	php		/tmp/snort_em037606_startcmd.php: [Snort] Enabling any flowbit-required rules for: WAN...
      Aug 14 21:02:06	php		/tmp/snort_em037606_startcmd.php: [Snort] Building new sid-msg.map file for WAN...
      Aug 14 21:02:06	php		/tmp/snort_em037606_startcmd.php: [Snort] Snort START for WAN(em0)...
      Aug 14 21:02:06	php-fpm	339	/snort/snort_interfaces.php: Starting Snort on WAN(em0) per user request...
      Aug 14 21:02:06	php		/tmp/snort_em037606_startcmd.php: [Snort] Updating rules configuration for: WAN ...
      Aug 14 21:02:07	snort	54172	FATAL ERROR: /usr/local/etc/snort/snort_37606_em0/rules/snort.rules(6384) Unknown rule option: 'stream_size'.
      Aug 14 21:02:07	php		/tmp/snort_em037606_startcmd.php: The command '/usr/local/bin/snort -R 37606 -D -q --suppress-config-log -l /var/log/snort/snort_em037606 --pid-path /var/run --nolock-pidfile -G 37606 -c /usr/local/etc/snort/snort_37606_em0/snort.conf -i em0' returned exit code '1', the output was ''
      

      ill check more

      1 Reply Last reply Reply Quote 0
      • x2rlX
        x2rl
        last edited by

        Found this

        @bmeeks said in Snort | Unknown rule option: 'stream_size'.:

        You most likely have a required preprocessor disabled.  Make sure the STREAM5 preprocessor is enabled on the PREPROCESSORS tab.  In fact, users should really never disable any of the default-enabled preprocessors unless they are very highly skilled with the operation of Snort.

        Bill

        Have never even been on that page. But fixed the issue by going to that page changing nothing and just hitting Save seem to work. Odd?

        1 Reply Last reply Reply Quote 0
        • bmeeksB
          bmeeks
          last edited by

          How exactly did you create the interface and when did you try to start it? Sounds like some initial configuration settings did not get set.

          1 Reply Last reply Reply Quote 0
          • First post
            Last post
          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.