Snort inilization failure

yoda715

I have 512mb, and after clicking 'save' it boots up fine. Far as I can tell no other processes are killed either.

And this line is incorrect:
Oct 31 22:47:14 SnortStartup[1307]: Ram free BEFORE starting Snort: 16M – Ram free AFTER starting Snort: 270M -- Mode ac-sparsebands -- Snort memory usage:

sullrich

We recommend 1024 megs.

http://wiki.pfsense.com/wikka.php?wakka=ReleaseCaveats

yoda715

Yea I've seen that. I didn't have problems with starting up until 1.0.1. I'll try getting more ram and see if that solves it.

sullrich

Nothing in snort changed in 1.0.1 except for 2 filter rules changes and the startup messages shown in the system log.

Hardly anything related to this.

yoda715

Upgraded to a new system: P4 2.4ghz, 1GB ram, 300gb HD (with 2gb swap).

Snort will not start up upon reboot. I have to click 'Save' under settings each time to get it to boot up.

I now have plenty of memory. When Snort does startup properly after clicking save, the total memory usage hovers around 57%. So I know it's not a memory issue now.

Also, there is no way this log statement is correct:
Nov 3 06:23:35 SnortStartup[1291]: Ram free BEFORE starting Snort: 18M – Ram free AFTER starting Snort: 444M -- Mode ac-sparsebands -- Snort memory usage:

sullrich

Uninstall snort and reinstall.

yoda715

That seems to have taken care of it. Did you make any changes?

sullrich

You probably installed during the development of the startup notification code. I'll bump the version this weekend.

yoda715

Grr. I just rebooted again, and it did not start up. I can't seem to find a pattern here.

yoda715

ok. The problem still exists. I've rebooted 5 times. Inbetween each reboot, I waited 10 minutes. During the first 3 minutes on each reboot, Snort would start to initialize. 3-4 minutes after rebooting, snort will exit. Only way to get snort to start is to click 'save' under snort settings. After clicking 'save' and about 3 minutes later, snort completes initialization and I start to receive alerts.

Here's the log of when it fails:

Nov 4 16:18:18 snort[1003]: Snort exiting
Nov 4 16:18:18 snort[1003]: Snort exiting
Nov 4 16:18:18 kernel: sis0: promiscuous mode disabled
Nov 4 16:18:18 snort[1003]: ===============================================================================
Nov 4 16:18:18 snort[1003]: ===============================================================================
Nov 4 16:18:18 snort[1003]: PASSED: 0
Nov 4 16:18:18 snort[1003]: PASSED: 0
Nov 4 16:18:18 snort[1003]: LOGGED: 0
Nov 4 16:18:18 snort[1003]: LOGGED: 0
Nov 4 16:18:18 snort[1003]: ALERTS: 0
Nov 4 16:18:18 snort[1003]: ALERTS: 0
Nov 4 16:18:18 snort[1003]: Action Stats:
Nov 4 16:18:18 snort[1003]: Action Stats:
Nov 4 16:18:18 snort[1003]: ===============================================================================
Nov 4 16:18:18 snort[1003]: ===============================================================================
Nov 4 16:18:18 snort[1003]: DISCARD: 0 (0.000%)
Nov 4 16:18:18 snort[1003]: DISCARD: 0 (0.000%)
Nov 4 16:18:18 snort[1003]: OTHER: 0 (0.000%)
Nov 4 16:18:18 snort[1003]: OTHER: 0 (0.000%)
Nov 4 16:18:18 snort[1003]: FRAG: 0 (0.000%)
Nov 4 16:18:18 snort[1003]: FRAG: 0 (0.000%)
Nov 4 16:18:18 snort[1003]: IPX: 0 (0.000%)
Nov 4 16:18:18 snort[1003]: IPX: 0 (0.000%)
Nov 4 16:18:18 snort[1003]: ETHLOOP: 0 (0.000%)
Nov 4 16:18:18 snort[1003]: ETHLOOP: 0 (0.000%)
Nov 4 16:18:18 snort[1003]: IPv6: 0 (0.000%)
Nov 4 16:18:18 snort[1003]: IPv6: 0 (0.000%)
Nov 4 16:18:18 snort[1003]: EAPOL: 0 (0.000%)
Nov 4 16:18:18 snort[1003]: EAPOL: 0 (0.000%)
Nov 4 16:18:18 snort[1003]: ARP: 0 (0.000%)
Nov 4 16:18:18 snort[1003]: ARP: 0 (0.000%)
Nov 4 16:18:18 snort[1003]: ICMP: 0 (0.000%)
Nov 4 16:18:18 snort[1003]: ICMP: 0 (0.000%)
Nov 4 16:18:18 snort[1003]: UDP: 0 (0.000%)
Nov 4 16:18:18 snort[1003]: UDP: 0 (0.000%)
Nov 4 16:18:18 snort[1003]: TCP: 0 (0.000%)
Nov 4 16:18:18 snort[1003]: TCP: 0 (0.000%)
Nov 4 16:18:18 snort[1003]: Breakdown by protocol:
Nov 4 16:18:18 snort[1003]: Breakdown by protocol:
Nov 4 16:18:18 snort[1003]: ===============================================================================
Nov 4 16:18:18 snort[1003]: ===============================================================================
Nov 4 16:18:18 snort[1003]: Outstanding: 709(66.887%)
Nov 4 16:18:18 snort[1003]: Outstanding: 709(66.887%)
Nov 4 16:18:18 snort[1003]: Dropped: 351(33.113%)
Nov 4 16:18:18 snort[1003]: Dropped: 351(33.113%)
Nov 4 16:18:18 snort[1003]: Analyzed: 0(0.000%)
Nov 4 16:18:18 snort[1003]: Analyzed: 0(0.000%)
Nov 4 16:18:18 snort[1003]: Snort received 1060 packets
Nov 4 16:18:18 snort[1003]: Snort received 1060 packets
Nov 4 16:18:18 snort[1003]: –----------------------------- Nov 4 16:18:18 snort[1003]: –-----------------------------
Nov 4 16:18:18 snort[1003]: Recovered Nodes: 0
Nov 4 16:18:18 snort[1003]: Recovered Nodes: 0
Nov 4 16:18:18 snort[1003]: Nodes: 0
Nov 4 16:18:18 snort[1003]: Nodes: 0
Nov 4 16:18:18 snort[1003]: Finds: 0 (Sucessful: 0(%0.000000) Unsucessful: 0(%0.000000))
Nov 4 16:18:18 snort[1003]: Finds: 0 (Sucessful: 0(%0.000000) Unsucessful: 0(%0.000000))
Nov 4 16:18:18 snort[1003]: Memcap: 2097152 Overhead Bytes: 262152
Nov 4 16:18:18 snort[1003]: Memcap: 2097152 Overhead Bytes: 262152
Nov 4 16:18:18 snort[1003]: ,–---[SERVER STATS]–----------
Nov 4 16:18:18 snort[1003]: ,–---[SERVER STATS]–----------
Nov 4 16:18:18 snort[1003]: Recovered Nodes: 0
Nov 4 16:18:18 snort[1003]: Recovered Nodes: 0
Nov 4 16:18:18 snort[1003]: Nodes: 0
Nov 4 16:18:18 snort[1003]: Nodes: 0
Nov 4 16:18:18 snort[1003]: Finds: 0 (Sucessful: 0(%0.000000) Unsucessful: 0(%0.000000))
Nov 4 16:18:18 snort[1003]: Finds: 0 (Sucessful: 0(%0.000000) Unsucessful: 0(%0.000000))
Nov 4 16:18:18 snort[1003]: Memcap: 25165824 Overhead Bytes: 4000016
Nov 4 16:18:18 snort[1003]: Memcap: 25165824 Overhead Bytes: 4000016
Nov 4 16:18:18 snort[1003]: UNIQUE_TRACKER STATS
Nov 4 16:18:18 snort[1003]: UNIQUE_TRACKER STATS
Nov 4 16:18:18 snort[1003]: Score Entry Size:: 112
Nov 4 16:18:18 snort[1003]: Score Entry Size:: 112
Nov 4 16:18:18 snort[1003]: Recovered Nodes: 0
Nov 4 16:18:18 snort[1003]: Recovered Nodes: 0
Nov 4 16:18:18 snort[1003]: Nodes: 0
Nov 4 16:18:18 snort[1003]: Nodes: 0
Nov 4 16:18:18 snort[1003]: Finds: 0 (Sucessful: 0(%0.000000) Unsucessful: 0(%0.000000))
Nov 4 16:18:18 snort[1003]: Finds: 0 (Sucessful: 0(%0.000000) Unsucessful: 0(%0.000000))
Nov 4 16:18:18 snort[1003]: Memcap: 6291456 Overhead Bytes: 1000032
Nov 4 16:18:18 snort[1003]: Memcap: 6291456 Overhead Bytes: 1000032
Nov 4 16:18:18 snort[1003]: SCOREBOARD_STATS: Portscanners
Nov 4 16:18:18 snort[1003]: SCOREBOARD_STATS: Portscanners
Nov 4 16:18:18 snort[1003]: Score Entry Size:: 112
Nov 4 16:18:18 snort[1003]: Score Entry Size:: 112
Nov 4 16:18:18 snort[1003]: Recovered Nodes: 0
Nov 4 16:18:18 snort[1003]: Recovered Nodes: 0
Nov 4 16:18:18 snort[1003]: Nodes: 0
Nov 4 16:18:18 snort[1003]: Nodes: 0
Nov 4 16:18:18 snort[1003]: Finds: 0 (Sucessful: 0(%0.000000) Unsucessful: 0(%0.000000))
Nov 4 16:18:18 snort[1003]: Finds: 0 (Sucessful: 0(%0.000000) Unsucessful: 0(%0.000000))
Nov 4 16:18:18 snort[1003]: Memcap: 25165824 Overhead Bytes: 120048
Nov 4 16:18:18 snort[1003]: Memcap: 25165824 Overhead Bytes: 120048
Nov 4 16:18:18 snort[1003]: SCOREBOARD_STATS: Active Talkers
Nov 4 16:18:18 snort[1003]: SCOREBOARD_STATS: Active Talkers
Nov 4 16:18:18 snort[1003]: +–-[ Flow-portscan Stats ]–--------------+
Nov 4 16:18:18 snort[1003]: +–-[ Flow-portscan Stats ]–--------------+
Nov 4 16:18:18 snort[1003]: finds: 0 reversed: 0(%0.000000) find_success: 0 find_fail: 0 percent_success: (%0.000000) new_flows: 0
Nov 4 16:18:18 snort[1003]: finds: 0 reversed: 0(%0.000000) find_success: 0 find_fail: 0 percent_success: (%0.000000) new_flows: 0
Nov 4 16:18:18 snort[1003]: IPV4 count: 0 frees: 0 low_time: 0, high_time: 0, diff: 0h:00:00s
Nov 4 16:18:18 snort[1003]: IPV4 count: 0 frees: 0 low_time: 0, high_time: 0, diff: 0h:00:00s
Nov 4 16:18:18 snort[1003]: Memcap: 10485760 Overhead Bytes 16400 used(%0.156403)/blocks (16400/1) Overhead blocks: 1 Could Hold: (0)
Nov 4 16:18:18 snort[1003]: Memcap: 10485760 Overhead Bytes 16400 used(%0.156403)/blocks (16400/1) Overhead blocks: 1 Could Hold: (0)
Nov 4 16:18:18 snort[1003]: ,–--[ FLOWCACHE STATS ]–--------
Nov 4 16:18:18 snort[1003]: ,–--[ FLOWCACHE STATS ]–--------
Nov 4 16:18:18 snort[1003]: Final Flow Statistics
Nov 4 16:18:18 snort[1003]: Final Flow Statistics
Nov 4 16:18:18 snort[1003]: *** Caught Term-Signal
Nov 4 16:18:18 snort[1003]: *** Caught Term-Signal
Nov 4 16:18:18 snort[1003]: Not Using PCAP_FRAMES
Nov 4 16:18:18 snort[1003]: Not Using PCAP_FRAMES
Nov 4 16:18:18 snort[1003]: Snort initialization completed successfully (pid=1003)
Nov 4 16:18:18 snort[1003]: Snort initialization completed successfully (pid=1003)
Nov 4 16:18:11 check_reload_status: updating dyndns
Nov 4 16:18:11 php: : [SNORT] Snort_dynamic_ip_reload.php is starting.
Nov 4 16:17:11 SnortStartup[1292]: Ram free BEFORE starting Snort: 18M – Ram free AFTER starting Snort: 702M -- Mode ac-sparsebands -- Snort memory usage:
Nov 4 16:16:54 snort2c[1253]: snort2c running in daemon mode pid: 1253
Nov 4 16:16:54 snort2c[1253]: snort2c running in daemon mode pid: 1253
Nov 4 16:16:54 snort[1092]: Daemon parent exiting
Nov 4 16:16:54 snort[1092]: Daemon parent exiting
Nov 4 16:16:52 snort[1092]: Child exited unexpectedly
Nov 4 16:16:52 snort[1092]: Child exited unexpectedly
Nov 4 16:16:51 snort[1242]: FATAL ERROR: Failed to Lock PID File "/var/run//snort_sis0.pid" for PID "1242"
Nov 4 16:16:51 snort[1242]: FATAL ERROR: Failed to Lock PID File "/var/run//snort_sis0.pid" for PID "1242"
Nov 4 16:16:51 snort[1242]: PID path stat checked out ok, PID path set to /var/run/
Nov 4 16:16:51 snort[1242]: PID path stat checked out ok, PID path set to /var/run/
Nov 4 16:16:51 snort[1242]: Var 'sis0_ADDRESS' redefined
Nov 4 16:16:51 snort[1242]: Var 'sis0_ADDRESS' redefined

billm

No wisdom to add here, but wtf?!?!?!?

Nov 4 16:17:11 SnortStartup[1292]: Ram free BEFORE starting Snort: 18M – Ram free AFTER starting Snort: 702M -- Mode ac-sparsebands -- Snort memory usage:

--Bill

yoda715

I see the same problem.

yoda715

I am also seeing snort randomly restart itself. It seems to happen in the middle of the night. Anyone seeing this in their logs?

sullrich

DHCP? It restarts after renewing the lease. Normal.

yoda715

Ok. That would explain random restarts. However, sometimes when it restarts at night it does not fully initialize and will terminate. I have to click save to start it up again.

PC_Arcade

@yoda715:

Ok. That would explain random restarts. However, sometimes when it restarts at night it does not fully initialize and will terminate. I have to click save to start it up again.

I'm getting this as well :

Nov 8 11:27:52 	kernel: fxp2: promiscuous mode disabled
Nov 8 11:27:52 	kernel: pid 83265 (snort), uid 0: exited on signal 11 (core dumped)
Nov 8 11:26:06 	snort[83265]: Not Using PCAP_FRAMES
Nov 8 11:26:06 	snort[83265]: Not Using PCAP_FRAMES
Nov 8 11:26:06 	snort[83265]: Snort initialization completed successfully (pid=83265)
Nov 8 11:26:06 	snort[83265]: Snort initialization completed successfully (pid=83265)

and again after pressing save :

Nov 8 11:34:55 	kernel: fxp2: promiscuous mode disabled
Nov 8 11:34:55 	kernel: pid 84220 (snort), uid 0: exited on signal 11 (core dumped)
Nov 8 11:33:25 	snort[84220]: Not Using PCAP_FRAMES
Nov 8 11:33:25 	snort[84220]: Not Using PCAP_FRAMES
Nov 8 11:33:25 	snort[84220]: Snort initialization completed successfully (pid=84220)
Nov 8 11:33:25 	snort[84220]: Snort initialization completed successfully (pid=84220)
Nov 8 11:33:02 	SnortStartup[84242]: Ram free BEFORE starting Snort: 110M -- Ram free AFTER starting Snort: 110M -- Mode ac-sparsebands -- Snort memory usage:

The problem is that it doesn't restart, I'm also not sure why it exited in the first place, it's not due to an IP change and 1Gb of ram should be enough

Specs = P4 2.4
1gb ram
3xIntel Pro 100 nics

yoda715

@PC_Arcade:

@yoda715:

Ok. That would explain random restarts. However, sometimes when it restarts at night it does not fully initialize and will terminate. I have to click save to start it up again.

I'm getting this as well :
Nov 8 11:27:52 	kernel: fxp2: promiscuous mode disabled
Nov 8 11:27:52 	kernel: pid 83265 (snort), uid 0: exited on signal 11 (core dumped)
Nov 8 11:26:06 	snort[83265]: Not Using PCAP_FRAMES
Nov 8 11:26:06 	snort[83265]: Not Using PCAP_FRAMES
Nov 8 11:26:06 	snort[83265]: Snort initialization completed successfully (pid=83265)
Nov 8 11:26:06 	snort[83265]: Snort initialization completed successfully (pid=83265)
and again after pressing save :
Nov 8 11:34:55 	kernel: fxp2: promiscuous mode disabled
Nov 8 11:34:55 	kernel: pid 84220 (snort), uid 0: exited on signal 11 (core dumped)
Nov 8 11:33:25 	snort[84220]: Not Using PCAP_FRAMES
Nov 8 11:33:25 	snort[84220]: Not Using PCAP_FRAMES
Nov 8 11:33:25 	snort[84220]: Snort initialization completed successfully (pid=84220)
Nov 8 11:33:25 	snort[84220]: Snort initialization completed successfully (pid=84220)
Nov 8 11:33:02 	SnortStartup[84242]: Ram free BEFORE starting Snort: 110M -- Ram free AFTER starting Snort: 110M -- Mode ac-sparsebands -- Snort memory usage:
The problem is that it doesn't restart, I'm also not sure why it exited in the first place, it's not due to an IP change and 1Gb of ram should be enough

Specs = P4 2.4
1gb ram
3xIntel Pro 100 nics

I have the same specs on my machine, however when I click save snort does successfully boot back up. If you are not running in ac-sparsebands mode, try running in that mode and see if it works for you.

At any rate at least I know I am not the only one with this problem.

PC_Arcade

It does load back up after I press save, but only for a minute or 2 then it bombs out again

sullrich

Nov 8 11:27:52 kernel: pid 83265 (snort), uid 0: exited on signal 11 (core dumped) …. Sounds like its running out of RAM.

PC_Arcade

On 1GB of ram?

Blimey!

Time to drop snort then :LOL:

The irony here is that it would run for ages on a machine with only 256mb of ram, so I upgraded to 1GB and it won't work for more than a minute or 2.

That's very odd behaviour.