Snort Update and Oinkmaster.conf
-
Forgot to mentiion, after reboots.
You need to start snort again from the settings tab. (click the save)
This is because snort wont start snort2c after reboots. (snort2c is the app the bloacks alerts.)
Snort2c not starting after reboots has been in snort package as long as I can remember.Im glad that the snort updates finnished.
This error meand that your system for somereson isnt seeing the new files.
Going to add a "rehash" after installs hopfully that will fix issue.
"snort[20732]: FATAL ERROR: Unable to open rules file: ../rules/local.rules or /usr/local/etc/snort/../rules/local.rules"James
-
James,
Thank you for the fast reply. Blocking is now working.
Thank you for your hard work! -
Sweeeeet…..
Its working, though my services list shows it as stopped even though its actively logging/blocking. Now I just have to fix my syslog (update of snapshot probably) so I can get a more detailed look at my Snort logs.
But since its up and blocking I think that means its 100% :D And mine has always started after reboot. Just tested it, and it started automatically after reboot as its logging/blocking, though it shows as stopped in the Services tab and won't start there. But as its working I'll leave it alone!
Thanks man, you rock. And roll. All night long.
edit
with no traffic
CPU usage - 29%
Memory usage - 34%
Not bad. Slight usage drop after switching to the different memory usage, might be able to fit in a few more rule sets…... -
Glad to see you guys with low system specs are running snort package.
Snort2c starting for some of us and not starting for some of us might be realted to system memory.
Im going to add more memory to my system and see if it helps.James
-
Ok now after I get more than one block in the Blocked tab the system CPU shoots off the roof rendering the system almost unusable.
It was not doing that in the previous pkg…. Any idea whats going?Edit:
Top shows that php is whats driving the cpu load crazy... and it only does it when I go to the blocked tab..
Any ideas?Edit 2:
I let the Blocked Page load and after of 4 Min trying to load it finally did to revel a few IP's blocked... Once the page load it the CPU load went down to the avg of 1% to 5%.... It looks like something is not right...
-
Ok now after I get more than one block in the Blocked tab the system CPU shoots off the roof rendering the system almost unusable.
It was not doing that in the previous pkg…. Any idea whats going?Edit:
Top shows that php is whats driving the cpu load crazy... and it only does it when I go to the blocked tab..
Any ideas?Edit 2:
I let the Blocked Page load and after of 4 Min trying to load it finally did to revel a few IP's blocked... Once the page load it the CPU load went down to the avg of 1% to 5%.... It looks like something is not right...
I have not touched any code related to the blocked tab. I have tryed to reproduce the error but every thing looks fine.
At most my system uses 3% when I click on the block tab. (I'm using firefox.)
Holy crap, just used IE8 on the pfsense gui, the gui responds 4x faster. wow.What web browser are you using ?
james
-
I try all of them and they do the same thing… Opera, Firefox, IE, Konqueror, Safari, etc....
Should I reinstall?
-
No dont reinstall, your killing your flash card.
I suspect all your problems are related to you hardware specs.
When I get the board you mailed me I'll install pfsense on there.
I should start to see the same gliches. Then I'll be able to fix the hickups asap.Just run snort as is for now. Don't worry I'll get to the bottom of this.
Also, Im still adding features, so dont reinstall for a while.james
-
Got it James.
Thank You very much!