Navigation

    Netgate Discussion Forum
    • Register
    • Login
    • Search
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search

    Snort still running even after uninstalled (in GUI)

    pfSense Packages
    4
    6
    2447
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • P
      Phobia last edited by

      Hi all,

      I see Snort starting and shutting down when I bring PFSense on or offline.  I had installed Snort to test, but by system only has 400mb RAM, and I saw that the requirements were higher so I uninstalled it using the package remove tool from within the WebGUI.

      Snort has now survived several reboots - I wanted to let you know in case its not normal. Also, how I can remove this from my system without messing things up?

      Thanks!

      – Phob

      1 Reply Last reply Reply Quote 0
      • Y
        yoda715 last edited by

        If you ssh into your pfsense box, enter the shell, and run the command 'top', what snort process do you see running?

        1 Reply Last reply Reply Quote 0
        • P
          Phobia last edited by

          Hi,

          PID: 758, Username: Root, THR: 1, PRI: -58, Nice: 0, Size: 12008K, RES: 11264K, State: bpf, Time: 0:06, WCPU 0.00%, Command: Snort

          It doesn't look like its using up any processor cycles, but it is using a fair chunk of memory.  As I said above, I see it starting during boot-up, and get the report on shut-down.

          Is there a way to manually un-install it?

          Thanks!

          – Phob

          1 Reply Last reply Reply Quote 0
          • U
            unforeseen last edited by

            Hey,

            Your best bet is make sure it is not running before uninstalling it. In the shell run: kill -9 758 until it says:  kill: (xxx) - No such process or just do: killall -9 snort  (Two times should be enough) Then try to unistall it via the panel and reboot. See if that does the trick.

            1 Reply Last reply Reply Quote 0
            • P
              Phobia last edited by

              Thanks for the tips… only one problem, it doesn't appear in the panel anymore.

              Should I attempt to re-install it then follow your instructions?

              Worth a shot either way.

              Thanks again,

              -- Phob

              1 Reply Last reply Reply Quote 0
              • J
                Justinw last edited by

                I would just ssh in and go to /usr/local/etc/rc.d  look for the snort startup script and delete it.  I don't imagine it works a whole lot different than other packages…

                1 Reply Last reply Reply Quote 0
                • First post
                  Last post