Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    [PFSense embeded] - 2nd time same crash - problem with snort ?!

    Scheduled Pinned Locked Moved General pfSense Questions
    3 Posts 2 Posters 1.9k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • D
      darxmurf
      last edited by

      Hi all,

      As it's the 2nd time I have this issue, let's discuss about it ! :)
      After few months of good service, I had exactly this issue
      http://www.mail-archive.com/support@pfsense.com/msg15583.html

      Not sure about the age of my CF card I decided to change it with a brand new one.

      2 days ago, exactly the same crash, 6 months after the new installation !

      Just before the "last" reboot of the machine I could see that my /var/ partition was 101% full (yes… -4.6mb free...). The size of the partition is around 58MB and there was 4 fat files (around 10mb each) in the /var/log/snort/ folder.
      Do you think that SNORT could cause a kind of "disk overflow" by writing too much ?! This could eventually be explain the complete crash of the system (and config lose) after reboot !
      config.xml file was ok before reboot but all the fields were blank in the webadmin!

      By chance I have a 2nd CF card ready as a backup but if somebody could explain this issue it could be cool... and I will kick out SNORT from now !

      Here is the config

      • Mini-itx
      • 2GB CF card
      • 2GB RAM
      • Embedded PFSense (latest version)
      • 1 GB LAN
      • 3 WAN with 3 different static IP and "load balancing"
      • 2mb symmetric total internet line
      • Only 5 computers are using this gateway

      And I'm in Argentina while the system is in Switzerland ! Yeah lucky me ! :-)

      1 Reply Last reply Reply Quote 0
      • J
        jamesdean
        last edited by

        Clear your /var/log/snort dir.

        Im going to add a cron job to auto remove data from /var/log/snort after 10mb.

        Hope this helps

        James

        1 Reply Last reply Reply Quote 0
        • D
          darxmurf
          last edited by

          too late  ;D I kicked out the package for the moment.
          As I'm a bit far away of the machine I prefer to avoid problems :)

          Just before the last reboot I tried to delete the logs…
          In my case df displayed the same 101% full even without the files.
          I had no time to play, the system was already dead :) so...

          But don't forget to restart snort after deleting the logs to release the disk space and restart a blank log :) thanks for your help !

          1 Reply Last reply Reply Quote 0
          • First post
            Last post
          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.