Snort crash: PHP Fatal error: Uncaught Error: Failed opening required '/usr/local/pkg/snort/snort.inc'

[Spectre 988]

Getting this crash error from Snort:

[06-Aug-2023 11:42:04 America/New_York] PHP Fatal error:  Uncaught Error: Failed opening required '/usr/local/pkg/snort/snort.inc' (include_path='.:/etc/inc:/usr/local/pfSense/include:/usr/local/pfSense/include/www:/usr/local/www:/usr/local/captiveportal:/usr/local/pkg:/usr/local/www/classes:/usr/local/www/classes/Form:/usr/local/share/pear:/usr/local/share/openssl_x509_crl/') in /tmp/snort_sync_cmds.php:2

I have two PfSense machine running. One on a VM and the other physical as a backup. I've removed Snort from the primary where I am getting this error message every time I restart the VM. On the Backup machine I have removed it as well. Not sure why the OS still sees the files but I will investigate further.

[bmeeks]

From your error messages I am guessing you had XMLSYNC enabled on the primary firewall. That will copy all of the Snort settings over to the secondary and any other machines configured on the Snort SYNC tab.

It appears the sync command file is still hanging around in /tmp/snort_sync_cmds.php. Find and delete that file if it exists on either firewall.

[Spectre 988]

@bmeeks I think that worked. Thanks much