Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Snort error - "unable to open alerfile - exit"

    Scheduled Pinned Locked Moved pfSense Packages
    5 Posts 3 Posters 2.4k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • C
      corvus
      last edited by

      I just installed 1.0, and decided to take a look at the new Snort package. I installed the package, got an oinkid, downloaded rules, checked many of them, and saved. I wasn't seeing any alerts after awhile, and I noticed this in the system log:

      "snort2c[838]: unable to open alertfile - exit"

      Any ideas?

      1 Reply Last reply Reply Quote 0
      • S
        sullrich
        last edited by

        Did you select a interface for Snort to listen on in the settings screen?

        Also does snort show as running in Status -> Services?

        1 Reply Last reply Reply Quote 0
        • C
          czappi
          last edited by

          Hi to all

          1.0-RELEASE
          I have the same Problem.

          The snort service stop and ist not possible to start.

          Oct 16 00:27:37 php: : SQUID is installed but not started. Not installing redirect rules.
          Oct 16 00:27:37 php: : SQUID is installed but not started. Not installing redirect rules.
          Oct 16 00:27:36 php: : FTP proxy disabled for interface opt1 - ignoring.
          Oct 16 00:27:36 miniupnpd[1309]: Unknown soap method
          Oct 16 00:27:35 squid[1186]: Squid Parent: child process 1188 exited due to signal 15

          Oct 16 00:27:35 snort2c[1302]: unable to open alertfile - exit
          Oct 16 00:27:35 snort2c[1302]: unable to open alertfile - exit
          Oct 16 00:27:35 snort2c[1302]: snort2c running in daemon mode pid: 1302
          Oct 16 00:27:35 snort2c[1302]: snort2c running in daemon mode pid: 1302

          1 Reply Last reply Reply Quote 0
          • C
            corvus
            last edited by

            @sullrich:

            Did you select a interface for Snort to listen on in the settings screen?

            Also does snort show as running in Status -> Services?

            WAN and OPT1 (dual-wan) are set to be monitored by Snort, and Snort is showed as "stopped" in services.

            1 Reply Last reply Reply Quote 0
            • S
              sullrich
              last edited by

              Okay, that is the problem.  Only monitor one LAN for the moment, that is a bug I need to fix.

              1 Reply Last reply Reply Quote 0
              • First post
                Last post
              Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.