Snort inilization failure
-
With the 1.0.1 update installed snort will not startup properly after a reboot of pfsense. I have snort running in ac-sparsebands mode. I get a snort inilization error failed in the system log. The only way to get Snort to startup after the reboot is to click 'Save' under 'Snort settings'. Anyone else noticed this issue?
-
Just installed 1.0.1 in a vmware vm and then installed snort, configured and rebooted. Each time snort was started as it should be.
-
Hmm. Odd. I just rebooted again and it worked. I swear it didn't work last time. I will see if I can find the pattern to reproduce it.
-
Ignore my previous post, it did it again after a few minutes. After about 5 minutes of up time, the snort process exits. Here's the log:
Last 200 system log entries
Oct 31 22:49:35 snort[968]: Snort exiting
Oct 31 22:49:35 snort[968]: Snort exiting
Oct 31 22:49:35 kernel: rl1: promiscuous mode disabled
Oct 31 22:49:35 snort[968]: ===============================================================================
Oct 31 22:49:35 snort[968]: ===============================================================================
Oct 31 22:49:35 snort[968]: PASSED: 0
Oct 31 22:49:35 snort[968]: PASSED: 0
Oct 31 22:49:35 snort[968]: LOGGED: 0
Oct 31 22:49:35 snort[968]: LOGGED: 0
Oct 31 22:49:35 snort[968]: ALERTS: 0
Oct 31 22:49:35 snort[968]: ALERTS: 0
Oct 31 22:49:35 snort[968]: Action Stats:
Oct 31 22:49:35 snort[968]: Action Stats:
Oct 31 22:49:35 snort[968]: ===============================================================================
Oct 31 22:49:35 snort[968]: ===============================================================================
Oct 31 22:49:35 snort[968]: DISCARD: 0 (0.000%)
Oct 31 22:49:35 snort[968]: DISCARD: 0 (0.000%)
Oct 31 22:49:35 snort[968]: OTHER: 0 (0.000%)
Oct 31 22:49:35 snort[968]: OTHER: 0 (0.000%)
Oct 31 22:49:35 snort[968]: FRAG: 0 (0.000%)
Oct 31 22:49:35 snort[968]: FRAG: 0 (0.000%)
Oct 31 22:49:35 snort[968]: IPX: 0 (0.000%)
Oct 31 22:49:35 snort[968]: IPX: 0 (0.000%)
Oct 31 22:49:35 snort[968]: ETHLOOP: 0 (0.000%)
Oct 31 22:49:35 snort[968]: ETHLOOP: 0 (0.000%)
Oct 31 22:49:35 snort[968]: IPv6: 0 (0.000%)
Oct 31 22:49:35 snort[968]: IPv6: 0 (0.000%)
Oct 31 22:49:35 snort[968]: EAPOL: 0 (0.000%)
Oct 31 22:49:35 snort[968]: EAPOL: 0 (0.000%)
Oct 31 22:49:35 snort[968]: ARP: 0 (0.000%)
Oct 31 22:49:35 snort[968]: ARP: 0 (0.000%)
Oct 31 22:49:35 snort[968]: ICMP: 0 (0.000%)
Oct 31 22:49:35 snort[968]: ICMP: 0 (0.000%)
Oct 31 22:49:35 snort[968]: UDP: 0 (0.000%)
Oct 31 22:49:35 snort[968]: UDP: 0 (0.000%)
Oct 31 22:49:35 snort[968]: TCP: 0 (0.000%)
Oct 31 22:49:35 snort[968]: TCP: 0 (0.000%)
Oct 31 22:49:35 snort[968]: Breakdown by protocol:
Oct 31 22:49:35 snort[968]: Breakdown by protocol:
Oct 31 22:49:35 snort[968]: ===============================================================================
Oct 31 22:49:35 snort[968]: ===============================================================================
Oct 31 22:49:35 snort[968]: Outstanding: 250(8.648%)
Oct 31 22:49:35 snort[968]: Outstanding: 250(8.648%)
Oct 31 22:49:35 snort[968]: Dropped: 2641(91.352%)
Oct 31 22:49:35 snort[968]: Dropped: 2641(91.352%)
Oct 31 22:49:35 snort[968]: Analyzed: 0(0.000%)
Oct 31 22:49:35 snort[968]: Analyzed: 0(0.000%)
Oct 31 22:49:35 snort[968]: Snort received 2891 packets
Oct 31 22:49:35 snort[968]: Snort received 2891 packets
Oct 31 22:49:35 snort[968]:–----------------------------- Oct 31 22:49:35 snort[968]:–-----------------------------
Oct 31 22:49:35 snort[968]: Recovered Nodes: 0
Oct 31 22:49:35 snort[968]: Recovered Nodes: 0
Oct 31 22:49:35 snort[968]: Nodes: 0
Oct 31 22:49:35 snort[968]: Nodes: 0
Oct 31 22:49:35 snort[968]: Finds: 0 (Sucessful: 0(%0.000000) Unsucessful: 0(%0.000000))
Oct 31 22:49:35 snort[968]: Finds: 0 (Sucessful: 0(%0.000000) Unsucessful: 0(%0.000000))
Oct 31 22:49:35 snort[968]: Memcap: 2097152 Overhead Bytes: 262152
Oct 31 22:49:35 snort[968]: Memcap: 2097152 Overhead Bytes: 262152
Oct 31 22:49:35 snort[968]: ,–---[SERVER STATS]–----------
Oct 31 22:49:35 snort[968]: ,–---[SERVER STATS]–----------
Oct 31 22:49:35 snort[968]: Recovered Nodes: 0
Oct 31 22:49:35 snort[968]: Recovered Nodes: 0
Oct 31 22:49:35 snort[968]: Nodes: 0
Oct 31 22:49:35 snort[968]: Nodes: 0
Oct 31 22:49:35 snort[968]: Finds: 0 (Sucessful: 0(%0.000000) Unsucessful: 0(%0.000000))
Oct 31 22:49:35 snort[968]: Finds: 0 (Sucessful: 0(%0.000000) Unsucessful: 0(%0.000000))
Oct 31 22:49:35 snort[968]: Memcap: 25165824 Overhead Bytes: 4000016
Oct 31 22:49:35 snort[968]: Memcap: 25165824 Overhead Bytes: 4000016
Oct 31 22:49:35 snort[968]: UNIQUE_TRACKER STATS
Oct 31 22:49:35 snort[968]: UNIQUE_TRACKER STATS
Oct 31 22:49:35 snort[968]: Score Entry Size:: 112
Oct 31 22:49:35 snort[968]: Score Entry Size:: 112
Oct 31 22:49:35 snort[968]: Recovered Nodes: 0
Oct 31 22:49:35 snort[968]: Recovered Nodes: 0
Oct 31 22:49:35 snort[968]: Nodes: 0
Oct 31 22:49:35 snort[968]: Nodes: 0
Oct 31 22:49:35 snort[968]: Finds: 0 (Sucessful: 0(%0.000000) Unsucessful: 0(%0.000000))
Oct 31 22:49:35 snort[968]: Finds: 0 (Sucessful: 0(%0.000000) Unsucessful: 0(%0.000000))
Oct 31 22:49:35 snort[968]: Memcap: 6291456 Overhead Bytes: 1000032
Oct 31 22:49:35 snort[968]: Memcap: 6291456 Overhead Bytes: 1000032
Oct 31 22:49:35 snort[968]: SCOREBOARD_STATS: Portscanners
Oct 31 22:49:35 snort[968]: SCOREBOARD_STATS: Portscanners
Oct 31 22:49:35 snort[968]: Score Entry Size:: 112
Oct 31 22:49:35 snort[968]: Score Entry Size:: 112
Oct 31 22:49:35 snort[968]: Recovered Nodes: 0
Oct 31 22:49:35 snort[968]: Recovered Nodes: 0
Oct 31 22:49:35 snort[968]: Nodes: 0
Oct 31 22:49:35 snort[968]: Nodes: 0
Oct 31 22:49:35 snort[968]: Finds: 0 (Sucessful: 0(%0.000000) Unsucessful: 0(%0.000000))
Oct 31 22:49:35 snort[968]: Finds: 0 (Sucessful: 0(%0.000000) Unsucessful: 0(%0.000000))
Oct 31 22:49:35 snort[968]: Memcap: 25165824 Overhead Bytes: 120048
Oct 31 22:49:35 snort[968]: Memcap: 25165824 Overhead Bytes: 120048
Oct 31 22:49:35 snort[968]: SCOREBOARD_STATS: Active Talkers
Oct 31 22:49:35 snort[968]: SCOREBOARD_STATS: Active Talkers
Oct 31 22:49:35 snort[968]: +–-[ Flow-portscan Stats ]–--------------+
Oct 31 22:49:35 snort[968]: +–-[ Flow-portscan Stats ]–--------------+
Oct 31 22:49:35 snort[968]: finds: 0 reversed: 0(%0.000000) find_success: 0 find_fail: 0 percent_success: (%0.000000) new_flows: 0
Oct 31 22:49:35 snort[968]: finds: 0 reversed: 0(%0.000000) find_success: 0 find_fail: 0 percent_success: (%0.000000) new_flows: 0
Oct 31 22:49:35 snort[968]: IPV4 count: 0 frees: 0 low_time: 0, high_time: 0, diff: 0h:00:00s
Oct 31 22:49:35 snort[968]: IPV4 count: 0 frees: 0 low_time: 0, high_time: 0, diff: 0h:00:00s
Oct 31 22:49:35 snort[968]: Memcap: 10485760 Overhead Bytes 16400 used(%0.156403)/blocks (16400/1) Overhead blocks: 1 Could Hold: (0)
Oct 31 22:49:35 snort[968]: Memcap: 10485760 Overhead Bytes 16400 used(%0.156403)/blocks (16400/1) Overhead blocks: 1 Could Hold: (0)
Oct 31 22:49:35 snort[968]: ,–--[ FLOWCACHE STATS ]–--------
Oct 31 22:49:35 snort[968]: ,–--[ FLOWCACHE STATS ]–--------
Oct 31 22:49:35 snort[968]: Final Flow Statistics
Oct 31 22:49:35 snort[968]: Final Flow Statistics
Oct 31 22:49:35 snort[968]: *** Caught Term-Signal
Oct 31 22:49:35 snort[968]: *** Caught Term-Signal
Oct 31 22:49:35 snort[968]: Not Using PCAP_FRAMES
Oct 31 22:49:35 snort[968]: Not Using PCAP_FRAMES
Oct 31 22:49:35 snort[968]: Snort initialization completed successfully (pid=968)
Oct 31 22:49:35 snort[968]: Snort initialization completed successfully (pid=968)
Oct 31 22:49:33 kernel: stray irq7
Oct 31 22:49:27 kernel: stray irq7
Oct 31 22:47:59 php: : phpDynDNS: No Change In My IP Address and/or 25 Days Has Not Past. Not Updating Dynamic DNS Entry.
Oct 31 22:47:59 php: : DynDns: Cached IP: *********
Oct 31 22:47:59 php: : DynDns: Current WAN IP: *********
Oct 31 22:47:59 php: : DynDns: _detectChange() starting.
Oct 31 22:47:59 php: : DynDns: updatedns() starting
Oct 31 22:47:59 php: : DynDns: Running updatedns()
Oct 31 22:47:50 check_reload_status: updating dyndns
Oct 31 22:47:50 php: : [SNORT] Snort_dynamic_ip_reload.php is starting.
Oct 31 22:47:14 SnortStartup[1307]: Ram free BEFORE starting Snort: 16M – Ram free AFTER starting Snort: 270M -- Mode ac-sparsebands -- Snort memory usage:
Oct 31 22:46:57 snort2c[1254]: snort2c running in daemon mode pid: 1254
Oct 31 22:46:57 snort2c[1254]: snort2c running in daemon mode pid: 1254
Oct 31 22:46:57 snort[1198]: Daemon parent exiting
Oct 31 22:46:57 snort[1198]: Daemon parent exiting
Oct 31 22:46:56 snort[1198]: Child exited unexpectedly
Oct 31 22:46:56 snort[1198]: Child exited unexpectedly
Oct 31 22:46:55 snort[1251]: FATAL ERROR: Failed to Lock PID File "/var/run//snort_rl1.pid" for PID "1251"
Oct 31 22:46:55 snort[1251]: FATAL ERROR: Failed to Lock PID File "/var/run//snort_rl1.pid" for PID "1251"
Oct 31 22:46:55 snort[1251]: PID path stat checked out ok, PID path set to /var/run/
Oct 31 22:46:55 snort[1251]: PID path stat checked out ok, PID path set to /var/run/
Oct 31 22:46:55 snort[1251]: Var 'rl1_ADDRESS' redefined
Oct 31 22:46:55 snort[1251]: Var 'rl1_ADDRESS' redefined
Oct 31 22:46:55 snort[1198]: Initializing daemon mode
Oct 31 22:46:55 snort[1198]: Initializing daemon mode
Oct 31 22:46:55 snort[1198]: , value = 24.99.96.0/255.255.252.0
Oct 31 22:46:55 snort[1198]: , value = 24.99.96.0/255.255.252.0
Oct 31 22:46:55 snort[1198]: Var 'rl1_ADDRESS' defined, value len = 24 chars
Oct 31 22:46:55 snort[1198]: Var 'rl1_ADDRESS' defined, value len = 24 chars
Oct 31 22:46:55 snort[1198]: Warning: flowbits key 'dce.isystemactivator.bind.call.attempt' is set but not ever checked.
Oct 31 22:46:55 snort[1198]: Warning: flowbits key 'dce.isystemactivator.bind.call.attempt' is set but not ever checked.
Oct 31 22:46:55 snort[1198]: Warning: flowbits key 'dce.bind.veritas' is set but not ever checked.
Oct 31 22:46:55 snort[1198]: Warning: flowbits key 'dce.bind.veritas' is set but not ever checked.
Oct 31 22:46:55 snort[1198]: Warning: flowbits key 'fkwp_conn_suc_cts' is set but not ever checked.
Oct 31 22:46:55 snort[1198]: Warning: flowbits key 'fkwp_conn_suc_cts' is set but not ever checked.
Oct 31 22:46:55 snort[1198]: Warning: flowbits key 'odf.file' is set but not ever checked.
Oct 31 22:46:55 snort[1198]: Warning: flowbits key 'odf.file' is set but not ever checked.
Oct 31 22:46:55 snort[1198]: Warning: flowbits key 'backdoor.charon.download.log.1' is checked but not ever set.
Oct 31 22:46:55 snort[1198]: Warning: flowbits key 'backdoor.charon.download.log.1' is checked but not ever set.
Oct 31 22:46:55 snort[1198]: Warning: flowbits key 'optixlite_fai_conn_cts' is set but not ever checked.
Oct 31 22:46:55 snort[1198]: Warning: flowbits key 'optixlite_fai_conn_cts' is set but not ever checked.
Oct 31 22:46:55 snort[1198]: Warning: flowbits key 'ms_sql_seen_dns' is checked but not ever set.
Oct 31 22:46:55 snort[1198]: Warning: flowbits key 'ms_sql_seen_dns' is checked but not ever set.
Oct 31 22:46:55 snort[1198]: Log directory = /var/log/snort
Oct 31 22:46:55 snort[1198]: Log directory = /var/log/snort
Oct 31 22:46:55 snort[1198]: Rule application order: ->activation->dynamic->pass->drop->alert->log
Oct 31 22:46:55 snort[1198]: Rule application order: ->activation->dynamic->pass->drop->alert->log
Oct 31 22:46:55 snort[1198]: –-----------------------------------------------------------------------------
Oct 31 22:46:55 snort[1198]: –-----------------------------------------------------------------------------
Oct 31 22:46:55 snort[1198]: | none
Oct 31 22:46:55 snort[1198]: | none
Oct 31 22:46:55 snort[1198]: +–---------------------[suppression]–----------------------------------------
Oct 31 22:46:55 snort[1198]: +–---------------------[suppression]–----------------------------------------
Oct 31 22:46:55 snort[1198]: | gen-id=1 sig-id=7760 type=Limit tracking=src count=1 seconds=600
Oct 31 22:46:55 snort[1198]: | gen-id=1 sig-id=7760 type=Limit tracking=src count=1 seconds=600
Oct 31 22:46:55 snort[1198]: | gen-id=1 sig-id=7531 type=Limit tracking=src count=1 seconds=6000
Oct 31 22:46:55 snort[1198]: | gen-id=1 sig-id=7531 type=Limit tracking=src count=1 seconds=6000
Oct 31 22:46:55 snort[1198]: | gen-id=1 sig-id=5829 type=Limit tracking=src count=1 seconds=300
Oct 31 22:46:55 snort[1198]: | gen-id=1 sig-id=5829 type=Limit tracking=src count=1 seconds=300
Oct 31 22:46:55 snort[1198]: | gen-id=1 sig-id=5891 type=Limit tracking=src count=1 seconds=300
Oct 31 22:46:55 snort[1198]: | gen-id=1 sig-id=5891 type=Limit tracking=src count=1 seconds=300
Oct 31 22:46:55 snort[1198]: | gen-id=1 sig-id=7182 type=Limit tracking=src count=1 seconds=300
Oct 31 22:46:55 snort[1198]: | gen-id=1 sig-id=7182 type=Limit tracking=src count=1 seconds=300
Oct 31 22:46:55 snort[1198]: | gen-id=1 sig-id=6290 type=Limit tracking=src count=1 seconds=300
Oct 31 22:46:55 snort[1198]: | gen-id=1 sig-id=6290 type=Limit tracking=src count=1 seconds=300
Oct 31 22:46:55 snort[1198]: | gen-id=1 sig-id=5836 type=Limit tracking=src count=1 seconds=600
Oct 31 22:46:55 snort[1198]: | gen-id=1 sig-id=5836 type=Limit tracking=src count=1 seconds=600
Oct 31 22:46:55 snort[1198]: | gen-id=1 sig-id=7593 type=Limit tracking=src count=1 seconds=300
Oct 31 22:46:55 snort[1198]: | gen-id=1 sig-id=7593 type=Limit tracking=src count=1 seconds=300
Oct 31 22:46:55 snort[1198]: | gen-id=1 sig-id=8464 type=Limit tracking=src count=1 seconds=300
Oct 31 22:46:55 snort[1198]: | gen-id=1 sig-id=8464 type=Limit tracking=src count=1 seconds=300
Oct 31 22:46:55 snort[1198]: | gen-id=1 sig-id=8071 type=Limit tracking=src count=1 seconds=300
Oct 31 22:46:55 snort[1198]: | gen-id=1 sig-id=8071 type=Limit tracking=src count=1 seconds=300
Oct 31 22:46:55 snort[1198]: | gen-id=1 sig-id=6490 type=Limit tracking=src count=1 seconds=300
Oct 31 22:46:55 snort[1198]: | gen-id=1 sig-id=6490 type=Limit tracking=src count=1 seconds=300
Oct 31 22:46:55 snort[1198]: | gen-id=1 sig-id=5824 type=Limit tracking=src count=1 seconds=60
Oct 31 22:46:55 snort[1198]: | gen-id=1 sig-id=5824 type=Limit tracking=src count=1 seconds=60
Oct 31 22:46:55 snort[1198]: | gen-id=1 sig-id=5945 type=Limit tracking=src count=1 seconds=300
Oct 31 22:46:55 snort[1198]: | gen-id=1 sig-id=5945 type=Limit tracking=src count=1 seconds=300
Oct 31 22:46:55 snort[1198]: | gen-id=1 sig-id=7558 type=Limit tracking=src count=1 seconds=600
Oct 31 22:46:55 snort[1198]: | gen-id=1 sig-id=7558 type=Limit tracking=src count=1 seconds=600
Oct 31 22:46:55 snort[1198]: | gen-id=1 sig-id=6232 type=Limit tracking=src count=1 seconds=300
Oct 31 22:46:55 snort[1198]: | gen-id=1 sig-id=6232 type=Limit tracking=src count=1 seconds=300
Oct 31 22:46:55 snort[1198]: | gen-id=1 sig-id=6174 type=Limit tracking=src count=1 seconds=300
Oct 31 22:46:55 snort[1198]: | gen-id=1 sig-id=6174 type=Limit tracking=src count=1 seconds=300
Oct 31 22:46:55 snort[1198]: | gen-id=1 sig-id=7141 type=Limit tracking=src count=1 seconds=600
Oct 31 22:46:55 snort[1198]: | gen-id=1 sig-id=7141 type=Limit tracking=src count=1 seconds=600 -
Not enough ram.
-
I have 512mb, and after clicking 'save' it boots up fine. Far as I can tell no other processes are killed either.
And this line is incorrect:
Oct 31 22:47:14 SnortStartup[1307]: Ram free BEFORE starting Snort: 16M – Ram free AFTER starting Snort: 270M -- Mode ac-sparsebands -- Snort memory usage: -
We recommend 1024 megs.
http://wiki.pfsense.com/wikka.php?wakka=ReleaseCaveats
-
Yea I've seen that. I didn't have problems with starting up until 1.0.1. I'll try getting more ram and see if that solves it.
-
Nothing in snort changed in 1.0.1 except for 2 filter rules changes and the startup messages shown in the system log.
Hardly anything related to this.
-
Upgraded to a new system: P4 2.4ghz, 1GB ram, 300gb HD (with 2gb swap).
Snort will not start up upon reboot. I have to click 'Save' under settings each time to get it to boot up.
I now have plenty of memory. When Snort does startup properly after clicking save, the total memory usage hovers around 57%. So I know it's not a memory issue now.
Also, there is no way this log statement is correct:
Nov 3 06:23:35 SnortStartup[1291]: Ram free BEFORE starting Snort: 18M – Ram free AFTER starting Snort: 444M -- Mode ac-sparsebands -- Snort memory usage: -
Uninstall snort and reinstall.
-
That seems to have taken care of it. Did you make any changes?
-
You probably installed during the development of the startup notification code. I'll bump the version this weekend.
-
Grr. I just rebooted again, and it did not start up. I can't seem to find a pattern here.
-
ok. The problem still exists. I've rebooted 5 times. Inbetween each reboot, I waited 10 minutes. During the first 3 minutes on each reboot, Snort would start to initialize. 3-4 minutes after rebooting, snort will exit. Only way to get snort to start is to click 'save' under snort settings. After clicking 'save' and about 3 minutes later, snort completes initialization and I start to receive alerts.
Here's the log of when it fails:
Nov 4 16:18:18 snort[1003]: Snort exiting
Nov 4 16:18:18 snort[1003]: Snort exiting
Nov 4 16:18:18 kernel: sis0: promiscuous mode disabled
Nov 4 16:18:18 snort[1003]: ===============================================================================
Nov 4 16:18:18 snort[1003]: ===============================================================================
Nov 4 16:18:18 snort[1003]: PASSED: 0
Nov 4 16:18:18 snort[1003]: PASSED: 0
Nov 4 16:18:18 snort[1003]: LOGGED: 0
Nov 4 16:18:18 snort[1003]: LOGGED: 0
Nov 4 16:18:18 snort[1003]: ALERTS: 0
Nov 4 16:18:18 snort[1003]: ALERTS: 0
Nov 4 16:18:18 snort[1003]: Action Stats:
Nov 4 16:18:18 snort[1003]: Action Stats:
Nov 4 16:18:18 snort[1003]: ===============================================================================
Nov 4 16:18:18 snort[1003]: ===============================================================================
Nov 4 16:18:18 snort[1003]: DISCARD: 0 (0.000%)
Nov 4 16:18:18 snort[1003]: DISCARD: 0 (0.000%)
Nov 4 16:18:18 snort[1003]: OTHER: 0 (0.000%)
Nov 4 16:18:18 snort[1003]: OTHER: 0 (0.000%)
Nov 4 16:18:18 snort[1003]: FRAG: 0 (0.000%)
Nov 4 16:18:18 snort[1003]: FRAG: 0 (0.000%)
Nov 4 16:18:18 snort[1003]: IPX: 0 (0.000%)
Nov 4 16:18:18 snort[1003]: IPX: 0 (0.000%)
Nov 4 16:18:18 snort[1003]: ETHLOOP: 0 (0.000%)
Nov 4 16:18:18 snort[1003]: ETHLOOP: 0 (0.000%)
Nov 4 16:18:18 snort[1003]: IPv6: 0 (0.000%)
Nov 4 16:18:18 snort[1003]: IPv6: 0 (0.000%)
Nov 4 16:18:18 snort[1003]: EAPOL: 0 (0.000%)
Nov 4 16:18:18 snort[1003]: EAPOL: 0 (0.000%)
Nov 4 16:18:18 snort[1003]: ARP: 0 (0.000%)
Nov 4 16:18:18 snort[1003]: ARP: 0 (0.000%)
Nov 4 16:18:18 snort[1003]: ICMP: 0 (0.000%)
Nov 4 16:18:18 snort[1003]: ICMP: 0 (0.000%)
Nov 4 16:18:18 snort[1003]: UDP: 0 (0.000%)
Nov 4 16:18:18 snort[1003]: UDP: 0 (0.000%)
Nov 4 16:18:18 snort[1003]: TCP: 0 (0.000%)
Nov 4 16:18:18 snort[1003]: TCP: 0 (0.000%)
Nov 4 16:18:18 snort[1003]: Breakdown by protocol:
Nov 4 16:18:18 snort[1003]: Breakdown by protocol:
Nov 4 16:18:18 snort[1003]: ===============================================================================
Nov 4 16:18:18 snort[1003]: ===============================================================================
Nov 4 16:18:18 snort[1003]: Outstanding: 709(66.887%)
Nov 4 16:18:18 snort[1003]: Outstanding: 709(66.887%)
Nov 4 16:18:18 snort[1003]: Dropped: 351(33.113%)
Nov 4 16:18:18 snort[1003]: Dropped: 351(33.113%)
Nov 4 16:18:18 snort[1003]: Analyzed: 0(0.000%)
Nov 4 16:18:18 snort[1003]: Analyzed: 0(0.000%)
Nov 4 16:18:18 snort[1003]: Snort received 1060 packets
Nov 4 16:18:18 snort[1003]: Snort received 1060 packets
Nov 4 16:18:18 snort[1003]:–----------------------------- Nov 4 16:18:18 snort[1003]:–-----------------------------
Nov 4 16:18:18 snort[1003]: Recovered Nodes: 0
Nov 4 16:18:18 snort[1003]: Recovered Nodes: 0
Nov 4 16:18:18 snort[1003]: Nodes: 0
Nov 4 16:18:18 snort[1003]: Nodes: 0
Nov 4 16:18:18 snort[1003]: Finds: 0 (Sucessful: 0(%0.000000) Unsucessful: 0(%0.000000))
Nov 4 16:18:18 snort[1003]: Finds: 0 (Sucessful: 0(%0.000000) Unsucessful: 0(%0.000000))
Nov 4 16:18:18 snort[1003]: Memcap: 2097152 Overhead Bytes: 262152
Nov 4 16:18:18 snort[1003]: Memcap: 2097152 Overhead Bytes: 262152
Nov 4 16:18:18 snort[1003]: ,–---[SERVER STATS]–----------
Nov 4 16:18:18 snort[1003]: ,–---[SERVER STATS]–----------
Nov 4 16:18:18 snort[1003]: Recovered Nodes: 0
Nov 4 16:18:18 snort[1003]: Recovered Nodes: 0
Nov 4 16:18:18 snort[1003]: Nodes: 0
Nov 4 16:18:18 snort[1003]: Nodes: 0
Nov 4 16:18:18 snort[1003]: Finds: 0 (Sucessful: 0(%0.000000) Unsucessful: 0(%0.000000))
Nov 4 16:18:18 snort[1003]: Finds: 0 (Sucessful: 0(%0.000000) Unsucessful: 0(%0.000000))
Nov 4 16:18:18 snort[1003]: Memcap: 25165824 Overhead Bytes: 4000016
Nov 4 16:18:18 snort[1003]: Memcap: 25165824 Overhead Bytes: 4000016
Nov 4 16:18:18 snort[1003]: UNIQUE_TRACKER STATS
Nov 4 16:18:18 snort[1003]: UNIQUE_TRACKER STATS
Nov 4 16:18:18 snort[1003]: Score Entry Size:: 112
Nov 4 16:18:18 snort[1003]: Score Entry Size:: 112
Nov 4 16:18:18 snort[1003]: Recovered Nodes: 0
Nov 4 16:18:18 snort[1003]: Recovered Nodes: 0
Nov 4 16:18:18 snort[1003]: Nodes: 0
Nov 4 16:18:18 snort[1003]: Nodes: 0
Nov 4 16:18:18 snort[1003]: Finds: 0 (Sucessful: 0(%0.000000) Unsucessful: 0(%0.000000))
Nov 4 16:18:18 snort[1003]: Finds: 0 (Sucessful: 0(%0.000000) Unsucessful: 0(%0.000000))
Nov 4 16:18:18 snort[1003]: Memcap: 6291456 Overhead Bytes: 1000032
Nov 4 16:18:18 snort[1003]: Memcap: 6291456 Overhead Bytes: 1000032
Nov 4 16:18:18 snort[1003]: SCOREBOARD_STATS: Portscanners
Nov 4 16:18:18 snort[1003]: SCOREBOARD_STATS: Portscanners
Nov 4 16:18:18 snort[1003]: Score Entry Size:: 112
Nov 4 16:18:18 snort[1003]: Score Entry Size:: 112
Nov 4 16:18:18 snort[1003]: Recovered Nodes: 0
Nov 4 16:18:18 snort[1003]: Recovered Nodes: 0
Nov 4 16:18:18 snort[1003]: Nodes: 0
Nov 4 16:18:18 snort[1003]: Nodes: 0
Nov 4 16:18:18 snort[1003]: Finds: 0 (Sucessful: 0(%0.000000) Unsucessful: 0(%0.000000))
Nov 4 16:18:18 snort[1003]: Finds: 0 (Sucessful: 0(%0.000000) Unsucessful: 0(%0.000000))
Nov 4 16:18:18 snort[1003]: Memcap: 25165824 Overhead Bytes: 120048
Nov 4 16:18:18 snort[1003]: Memcap: 25165824 Overhead Bytes: 120048
Nov 4 16:18:18 snort[1003]: SCOREBOARD_STATS: Active Talkers
Nov 4 16:18:18 snort[1003]: SCOREBOARD_STATS: Active Talkers
Nov 4 16:18:18 snort[1003]: +–-[ Flow-portscan Stats ]–--------------+
Nov 4 16:18:18 snort[1003]: +–-[ Flow-portscan Stats ]–--------------+
Nov 4 16:18:18 snort[1003]: finds: 0 reversed: 0(%0.000000) find_success: 0 find_fail: 0 percent_success: (%0.000000) new_flows: 0
Nov 4 16:18:18 snort[1003]: finds: 0 reversed: 0(%0.000000) find_success: 0 find_fail: 0 percent_success: (%0.000000) new_flows: 0
Nov 4 16:18:18 snort[1003]: IPV4 count: 0 frees: 0 low_time: 0, high_time: 0, diff: 0h:00:00s
Nov 4 16:18:18 snort[1003]: IPV4 count: 0 frees: 0 low_time: 0, high_time: 0, diff: 0h:00:00s
Nov 4 16:18:18 snort[1003]: Memcap: 10485760 Overhead Bytes 16400 used(%0.156403)/blocks (16400/1) Overhead blocks: 1 Could Hold: (0)
Nov 4 16:18:18 snort[1003]: Memcap: 10485760 Overhead Bytes 16400 used(%0.156403)/blocks (16400/1) Overhead blocks: 1 Could Hold: (0)
Nov 4 16:18:18 snort[1003]: ,–--[ FLOWCACHE STATS ]–--------
Nov 4 16:18:18 snort[1003]: ,–--[ FLOWCACHE STATS ]–--------
Nov 4 16:18:18 snort[1003]: Final Flow Statistics
Nov 4 16:18:18 snort[1003]: Final Flow Statistics
Nov 4 16:18:18 snort[1003]: *** Caught Term-Signal
Nov 4 16:18:18 snort[1003]: *** Caught Term-Signal
Nov 4 16:18:18 snort[1003]: Not Using PCAP_FRAMES
Nov 4 16:18:18 snort[1003]: Not Using PCAP_FRAMES
Nov 4 16:18:18 snort[1003]: Snort initialization completed successfully (pid=1003)
Nov 4 16:18:18 snort[1003]: Snort initialization completed successfully (pid=1003)
Nov 4 16:18:11 check_reload_status: updating dyndns
Nov 4 16:18:11 php: : [SNORT] Snort_dynamic_ip_reload.php is starting.
Nov 4 16:17:11 SnortStartup[1292]: Ram free BEFORE starting Snort: 18M – Ram free AFTER starting Snort: 702M -- Mode ac-sparsebands -- Snort memory usage:
Nov 4 16:16:54 snort2c[1253]: snort2c running in daemon mode pid: 1253
Nov 4 16:16:54 snort2c[1253]: snort2c running in daemon mode pid: 1253
Nov 4 16:16:54 snort[1092]: Daemon parent exiting
Nov 4 16:16:54 snort[1092]: Daemon parent exiting
Nov 4 16:16:52 snort[1092]: Child exited unexpectedly
Nov 4 16:16:52 snort[1092]: Child exited unexpectedly
Nov 4 16:16:51 snort[1242]: FATAL ERROR: Failed to Lock PID File "/var/run//snort_sis0.pid" for PID "1242"
Nov 4 16:16:51 snort[1242]: FATAL ERROR: Failed to Lock PID File "/var/run//snort_sis0.pid" for PID "1242"
Nov 4 16:16:51 snort[1242]: PID path stat checked out ok, PID path set to /var/run/
Nov 4 16:16:51 snort[1242]: PID path stat checked out ok, PID path set to /var/run/
Nov 4 16:16:51 snort[1242]: Var 'sis0_ADDRESS' redefined
Nov 4 16:16:51 snort[1242]: Var 'sis0_ADDRESS' redefined -
No wisdom to add here, but wtf?!?!?!?
Nov 4 16:17:11 SnortStartup[1292]: Ram free BEFORE starting Snort: 18M – Ram free AFTER starting Snort: 702M -- Mode ac-sparsebands -- Snort memory usage:
--Bill
-
I see the same problem.
-
I am also seeing snort randomly restart itself. It seems to happen in the middle of the night. Anyone seeing this in their logs?
-
DHCP? It restarts after renewing the lease. Normal.
-
Ok. That would explain random restarts. However, sometimes when it restarts at night it does not fully initialize and will terminate. I have to click save to start it up again.
-
Ok. That would explain random restarts. However, sometimes when it restarts at night it does not fully initialize and will terminate. I have to click save to start it up again.
I'm getting this as well :
Nov 8 11:27:52 kernel: fxp2: promiscuous mode disabled Nov 8 11:27:52 kernel: pid 83265 (snort), uid 0: exited on signal 11 (core dumped) Nov 8 11:26:06 snort[83265]: Not Using PCAP_FRAMES Nov 8 11:26:06 snort[83265]: Not Using PCAP_FRAMES Nov 8 11:26:06 snort[83265]: Snort initialization completed successfully (pid=83265) Nov 8 11:26:06 snort[83265]: Snort initialization completed successfully (pid=83265)and again after pressing save :
Nov 8 11:34:55 kernel: fxp2: promiscuous mode disabled Nov 8 11:34:55 kernel: pid 84220 (snort), uid 0: exited on signal 11 (core dumped) Nov 8 11:33:25 snort[84220]: Not Using PCAP_FRAMES Nov 8 11:33:25 snort[84220]: Not Using PCAP_FRAMES Nov 8 11:33:25 snort[84220]: Snort initialization completed successfully (pid=84220) Nov 8 11:33:25 snort[84220]: Snort initialization completed successfully (pid=84220) Nov 8 11:33:02 SnortStartup[84242]: Ram free BEFORE starting Snort: 110M -- Ram free AFTER starting Snort: 110M -- Mode ac-sparsebands -- Snort memory usage:The problem is that it doesn't restart, I'm also not sure why it exited in the first place, it's not due to an IP change and 1Gb of ram should be enough
Specs = P4 2.4
1gb ram
3xIntel Pro 100 nics -
Ok. That would explain random restarts. However, sometimes when it restarts at night it does not fully initialize and will terminate. I have to click save to start it up again.
I'm getting this as well :
Nov 8 11:27:52 kernel: fxp2: promiscuous mode disabled Nov 8 11:27:52 kernel: pid 83265 (snort), uid 0: exited on signal 11 (core dumped) Nov 8 11:26:06 snort[83265]: Not Using PCAP_FRAMES Nov 8 11:26:06 snort[83265]: Not Using PCAP_FRAMES Nov 8 11:26:06 snort[83265]: Snort initialization completed successfully (pid=83265) Nov 8 11:26:06 snort[83265]: Snort initialization completed successfully (pid=83265)and again after pressing save :
Nov 8 11:34:55 kernel: fxp2: promiscuous mode disabled Nov 8 11:34:55 kernel: pid 84220 (snort), uid 0: exited on signal 11 (core dumped) Nov 8 11:33:25 snort[84220]: Not Using PCAP_FRAMES Nov 8 11:33:25 snort[84220]: Not Using PCAP_FRAMES Nov 8 11:33:25 snort[84220]: Snort initialization completed successfully (pid=84220) Nov 8 11:33:25 snort[84220]: Snort initialization completed successfully (pid=84220) Nov 8 11:33:02 SnortStartup[84242]: Ram free BEFORE starting Snort: 110M -- Ram free AFTER starting Snort: 110M -- Mode ac-sparsebands -- Snort memory usage:The problem is that it doesn't restart, I'm also not sure why it exited in the first place, it's not due to an IP change and 1Gb of ram should be enough
Specs = P4 2.4
1gb ram
3xIntel Pro 100 nicsI have the same specs on my machine, however when I click save snort does successfully boot back up. If you are not running in ac-sparsebands mode, try running in that mode and see if it works for you.
At any rate at least I know I am not the only one with this problem.
-
It does load back up after I press save, but only for a minute or 2 then it bombs out again
-
Nov 8 11:27:52 kernel: pid 83265 (snort), uid 0: exited on signal 11 (core dumped) …. Sounds like its running out of RAM.
-
On 1GB of ram?
Blimey!
Time to drop snort then :LOL:
The irony here is that it would run for ages on a machine with only 256mb of ram, so I upgraded to 1GB and it won't work for more than a minute or 2.
That's very odd behaviour.
-
1 gig should be plenty. Not sure why its core dumping then.. Shrugs.
-
I am running 1 gig as well. I know its not shutting down due to low ram. When snort is running my memory usage stays around 55-60%. At no point do I see my memory reach 80, 90, or 100%. I have swap enabled and it's always at 0%. When snort is not running my mem usage is 5-6%.
I am not trying to insult you Scott nor do I doubt your intelligence on this issue, but I can say this with 99% certainty: The issue is something other than running out of ram. :)
So basically Snort is not starting up on reboots, and on dhcp renewal.
Do you want me to send you a copy of my config Scott, to see if you can get this to duplicate?
-
I am running 1 gig as well. I know its not shutting down due to low ram. When snort is running my memory usage stays around 55-60%. At no point do I see my memory reach 80, 90, or 100%. I have swap enabled and it's always at 0%. When snort is not running my mem usage is 5-6%.
I am not trying to insult you Scott nor do I doubt your intelligence on this issue, but I can say this with 99% certainty: The issue is something other than running out of ram. :)
So basically Snort is not starting up on reboots, and on dhcp renewal.
Do you want me to send you a copy of my config Scott, to see if you can get this to duplicate?
All the above applies to me too, as does the offer of configs and any other help I can give :)
-
I've noticed something in my testing. It seems that whatever is causing snort to fail on bootup the first time, it's towards the end of the bootup process.
-
I take it the offer of configs and logs is not wanted?
Would a donation help to get this looked at?
-
Try uninstalling and reinstalling the package. I just uploaded a re compiled version.
-
Still experiencing the same issue. Had to click save after reinstall and reboot to get Snort to startup. Any luck PC_Arcade?
-
You may also want to upgrade to http://www.pfsense.com/~sullrich/1.0.1-SNAPSHOT-11-19-2006/
6.2-RC1
-
I have tested the snort package under 1.01 about a week ago and it ran fine for me, although I only ran it for about a couple of days. Not to throw out the obvious here, but if pc_arcade had it running under 256 but not under a gig, it sounds like there is a good possibility that there is possibly some bad ram in the mix. I'd run a checkmem on it and see what happens.
-
You may also want to upgrade to http://www.pfsense.com/~sullrich/1.0.1-SNAPSHOT-11-19-2006/
6.2-RC1
Will do. Does that need to be a fresh install or will an upgrade be ok?
-
I have tested the snort package under 1.01 about a week ago and it ran fine for me, although I only ran it for about a couple of days. Not to throw out the obvious here, but if pc_arcade had it running under 256 but not under a gig, it sounds like there is a good possibility that there is possibly some bad ram in the mix. I'd run a checkmem on it and see what happens.
Doubt it. If it was a bad batch of Memory it wouldn't run at all.
-
-
No go. Snort initialization is stuck in an infinite loop. It will initialize, reach about 90% bootup complete, terminate, and start over. I'm counting five times so far that it has started to initialize, failed, restarted initialization, and it keeps failing over and over.
-
Clicking Save in snort settings stopped the loop and successfully booted Snort.
-
Hi, Just 'd like to ask what's the status here with the issue ?
my pfsense is 1.0.1
Last time it was with 1.0-RC3 when snort caused network problem
and it was quite a headache to try to find out what's wrong till
we have to take off snort all together.I assume then 6.2 RC1 ( Scott's earlier link ) + snort works alright ?
I have more than 1 G ram for pfsense.
Cheers,