Snort still running even after uninstalled (in GUI)
I see Snort starting and shutting down when I bring PFSense on or offline. I had installed Snort to test, but by system only has 400mb RAM, and I saw that the requirements were higher so I uninstalled it using the package remove tool from within the WebGUI.
Snort has now survived several reboots - I wanted to let you know in case its not normal. Also, how I can remove this from my system without messing things up?
If you ssh into your pfsense box, enter the shell, and run the command 'top', what snort process do you see running?
PID: 758, Username: Root, THR: 1, PRI: -58, Nice: 0, Size: 12008K, RES: 11264K, State: bpf, Time: 0:06, WCPU 0.00%, Command: Snort
It doesn't look like its using up any processor cycles, but it is using a fair chunk of memory. As I said above, I see it starting during boot-up, and get the report on shut-down.
Is there a way to manually un-install it?
Your best bet is make sure it is not running before uninstalling it. In the shell run: kill -9 758 until it says: kill: (xxx) - No such process or just do: killall -9 snort (Two times should be enough) Then try to unistall it via the panel and reboot. See if that does the trick.
Thanks for the tips… only one problem, it doesn't appear in the panel anymore.
Should I attempt to re-install it then follow your instructions?
Worth a shot either way.
I would just ssh in and go to /usr/local/etc/rc.d look for the snort startup script and delete it. I don't imagine it works a whole lot different than other packages…