Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Snort Won't Start After Upgrade

    pfSense Packages
    64
    301
    212.2k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • C
      Cino
      last edited by

      @ermal:

      Well the whitelist option in snort:interfaces:edit works only if Block offenders is on!

      I had Block offenders on and it was blocking whitelist IPs. I noticed you made some more changes… I'll update and retest

      EDIT:  new issue, snort wont start. See below:

      
Aug 3 15:16:23 	SnortStartup[13847]: Snort HARD Reload For 39737_em3...
Aug 3 15:16:23 	snort[13005]: FATAL ERROR: parser.c(5165) Could not stat dynamic module path "/usr/local/lib/snort/dynamicpreprocessor": No such file or directory.
Aug 3 15:16:23 	snort[13005]: FATAL ERROR: parser.c(5165) Could not stat dynamic module path "/usr/local/lib/snort/dynamicpreprocessor": No such file or directory.
      1 Reply Last reply Reply Quote 0
      • C
        Cino
        last edited by

        also change https://github.com/bsdperimeter/pfsense/commit/27018d3cc4f12c995efadf5dc5ba90eb7c1aa641 is still removing package menu items. I see that you put a piece back in https://github.com/bsdperimeter/pfsense/commit/05ca39d93d972908e61da6f1b0b9132dd39b017b but that didn't fix it

        as i re-install a package, its removing the last installed package from the menu

        Edit: I' opened a ticket on this as this has nothing to do with Snort but with 2.1 Development code, ticket 1743

        1 Reply Last reply Reply Quote 0
        • M
          mschiek01
          last edited by

          @Cino:

          @ermal:

          Well the whitelist option in snort:interfaces:edit works only if Block offenders is on!

          I had Block offenders on and it was blocking whitelist IPs. I noticed you made some more changes… I'll update and retest

          EDIT:  new issue, snort wont start. See below:

          
Aug 3 15:16:23 	SnortStartup[13847]: Snort HARD Reload For 39737_em3...
Aug 3 15:16:23 	snort[13005]: FATAL ERROR: parser.c(5165) Could not stat dynamic module path "/usr/local/lib/snort/dynamicpreprocessor": No such file or directory.
Aug 3 15:16:23 	snort[13005]: FATAL ERROR: parser.c(5165) Could not stat dynamic module path "/usr/local/lib/snort/dynamicpreprocessor": No such file or directory.

          I can confirm same issue as above on the latest update.  I do not have a problem with the package removal though

          1 Reply Last reply Reply Quote 0
          • E
            eri--
            last edited by

            Hmm just remove and reinstall the binaries again not just the snort files.
            Those are files that come wiht the package difficult to loose those without something wrong :)

            EDIT:

            I put another fix to prevent the errors you are seeing.

            1 Reply Last reply Reply Quote 0
            • C
              Cino
              last edited by

              @ermal:

              Hmm just remove and reinstall the binaries again not just the snort files.
              Those are files that come wiht the package difficult to loose those without something wrong :)

              All my re-installs have been 'Reinstall this Package'

              btw, thank you very much for the quick responses on fixing the snort package as i'v been finding issues… I've been kind hoping other users would be reporting on issues other then myself since there was an outcry for snort a week ago...

              1 Reply Last reply Reply Quote 0
              • M
                mdovey
                last edited by

                I've already done two reinstalls of PfSense 2RC3 in the last week due to things going awry during a snapshot update (which may or may not have been related to having snort or snort-dev installed), and my first attempt to install the new snort didn't go too well (Snort was missing from the menu and services list after installation but someone else reported this before I could, with more insight as to the circumstances under which it occurred than I had).

                So I'm afraid, I'm sitting on the fence at the moment, waiting for an all-clear!

                Matthew

                1 Reply Last reply Reply Quote 0
                • M
                  mschiek01
                  last edited by

                  @ermal:

                  Hmm just remove and reinstall the binaries again not just the snort files.
                  Those are files that come wiht the package difficult to loose those without something wrong :)

                  EDIT:

                  I put another fix to prevent the errors you are seeing.

                  Just did a reinstall same error:
                  Aug 3 15:06:12 snort[18906]: FATAL ERROR: parser.c(5165) Could not stat dynamic module path "/usr/local/lib/snort/dynamicpreprocessor": No such file or directory.
                  Aug 3 15:06:12 snort[18906]: FATAL ERROR: parser.c(5165) Could not stat dynamic module path "/usr/local/lib/snort/dynamicpreprocessor": No such file or directory.

                  Snort was this morning this only started occurring after the reinstall.

                  1 Reply Last reply Reply Quote 0
                  • C
                    Cino
                    last edited by

                    @emarl  Im able to start snort again :-) had some issues starting it but i forgot that in my main home net list, i have to uncheck 'Add WAN DNS servers to the list.' since I have a IPv6 in my WAN DNS entries. Snort doesn't like IPv6 yet.

                    looking at the conf file, my net list is there.. Going to test the IDS then enable blocking and see if whitelist works again.

                    EDIT:  Issue with the suppress file again. The file looks good

                    the file:

                    
# This file is auto generated by the snort package. Please do not edit this file by hand.

suppress gen_id 119, sig_id 2, track by_src, ip 68.x.x.x

                    system log

                    
Aug 3 16:28:32 	SnortStartup[57067]: Interface Rule START for 0_39737_em3...
Aug 3 16:28:32 	snort[56934]: FATAL ERROR: /usr/local/etc/snort/suppress/(1) Invalid configuration line: Ú^Y^O
Aug 3 16:28:32 	snort[56934]: FATAL ERROR: /usr/local/etc/snort/suppress/(1) Invalid configuration line: Ú^Y^O

                    Whitelist isn't working. It is creating the file but there is a space in the name "MainWhiteList 10285" Also when I check 'Block offenders' and Select 'MainWhiteList' from the drop down; it goes back to 'default' when i click on 'Save'

                    1 Reply Last reply Reply Quote 0
                    • E
                      eri--
                      last edited by

                      mschiek01: Remove the package and install it again.
                      Do not use the reinstall features but really delete and install the pacakge.

                      That will fix your issue and it should not happen again after that.

                      1 Reply Last reply Reply Quote 0
                      • E
                        eri--
                        last edited by

                        @cion

                        should be fixed the issues with whitelist selection and suppress.

                        1 Reply Last reply Reply Quote 0
                        • C
                          Cino
                          last edited by

                          thanks again Ermal!! I can't test right now but later tonight I will remove everything snort relate, do a firmware update(maybe a fresh install) and after my packages update i'll install snort.

                          not sure how this happen but I started up some bit-torrent downloads and it killed snort i think but it could just be my box..

                          
Aug 3 17:01:11 	snort[26553]: FATAL ERROR: s2c_pf_block() => ioctl() DIOCRADDADDRS
Aug 3 17:01:11 	snort[26553]: FATAL ERROR: s2c_pf_block() => ioctl() DIOCRADDADDRS

                          when i started it back i got this:

                          
Aug 3 17:03:41 	SnortStartup[59006]: Interface Rule START for 0_39737_em3...
Aug 3 17:03:41 	snort[58868]: FATAL ERROR: pf.conf => Table snort2c don't exists in packet filter
Aug 3 17:03:41 	snort[58868]: FATAL ERROR: pf.conf => Table snort2c don't exists in packet filter

                          but i'm having issues with countryblock now so i need to do a reset before I can test again

                          1 Reply Last reply Reply Quote 0
                          • E
                            eri--
                            last edited by

                            That is IDS integration which might need some people to help out in funding to make properly usable.

                            1 Reply Last reply Reply Quote 0
                            • H
                              hmishra
                              last edited by

                              I am having the same issue now of not seeing Snort menu entry under Services, even after successful install. I have uninstalled and installed the Snort package a couple times already as per the earlier suggestion.

                              I see the following error messages on system log which I thought were relevant:

                              Aug 3 17:28:50 SnortStartup[36465]: Snort HARD Reload For 21540_em0_vlan10…
                              Aug 3 17:28:50 snort[36189]: FATAL ERROR: Unable to open rules file "/usr/local/etc/snort/snort_21540_em0_vlan10//usr/local/etc/snort/snort_21540_em0_vlan10/rules/emerging-botcc.rules": No such file or directory.
                              Aug 3 17:28:50 snort[36189]: FATAL ERROR: Unable to open rules file "/usr/local/etc/snort/snort_21540_em0_vlan10//usr/local/etc/snort/snort_21540_em0_vlan10/rules/emerging-botcc.rules": No such file or directory.

                              Now even if there were some issues with the category 'emerging-botcc.rules', I cannot uncheck those now since I cannot bring up Snort setting to uncheck those.

                              1 Reply Last reply Reply Quote 0
                              • M
                                mschiek01
                                last edited by

                                @ermal:

                                mschiek01: Remove the package and install it again.
                                Do not use the reinstall features but really delete and install the pacakge.

                                That will fix your issue and it should not happen again after that.

                                That fixed the issue.

                                Thanks again for addressing this quickly.

                                1 Reply Last reply Reply Quote 0
                                • H
                                  hmishra
                                  last edited by

                                  Ok, Snort is running now. I had to export the config xml and edit out the rule categories which were generating exceptions on system log as stated before. Once I restored it, Snort is now running although I still feel that Snort should not die if choosing what it considers as a invalid category.

                                  Anyway, now I have a different issue which I am not sure if it is Snort install related since I also updated to the latest snapshot. Now, I can install Squid or Squidguard or Cron individually, but if I install more than one, the other gets bumped off of the services list. Even the menu entry for the previous package is lost. In other words, only one service can be active at a time from among installable packages. This is just a rough observation since I haven't tried all different combinations of packages.

                                  1 Reply Last reply Reply Quote 0
                                  • C
                                    Cino
                                    last edited by

                                    @ermal:

                                    That is IDS integration which might need some people to help out in funding to make properly usable.

                                    What IDS integration are you talking about?

                                    So far so good! Whitelist looks to be working. I notice the format of the file has change. Suppress file seems to load without errors, have not tested yet. thank you again!

                                    1 Reply Last reply Reply Quote 0
                                    • C
                                      Cino
                                      last edited by

                                      @hmishra:

                                      Ok, Snort is running now. I had to export the config xml and edit out the rule categories which were generating exceptions on system log as stated before. Once I restored it, Snort is now running although I still feel that Snort should not die if choosing what it considers as a invalid category.

                                      Anyway, now I have a different issue which I am not sure if it is Snort install related since I also updated to the latest snapshot. Now, I can install Squid or Squidguard or Cron individually, but if I install more than one, the other gets bumped off of the services list. Even the menu entry for the previous package is lost. In other words, only one service can be active at a time from among installable packages. This is just a rough observation since I haven't tried all different combinations of packages.

                                      how long since you updated? try it again since it seems to be fix for me

                                      1 Reply Last reply Reply Quote 0
                                      • H
                                        hmishra
                                        last edited by

                                        Just tried it, still no joy. Having installed Snort first, I tried to install Cron and that bumped off the Snort menu entry under Services.

                                        1 Reply Last reply Reply Quote 0
                                        • E
                                          eri--
                                          last edited by

                                          You need to update to latest snapshot to fix the issues with the menu.

                                          @Cino,

                                          IDS integration is the Block offenders option

                                          1 Reply Last reply Reply Quote 0
                                          • C
                                            Cino
                                            last edited by

                                            @Ermal The suppress list is working. Snort stayed up last night. Need to do some more testing but block ip's didn't clear after the set time i selected. My time is set to block for 1 hour, I had IPs in there that were blocked 8 hours ago.

                                            Edit: I did some more testing and its not removing IPs from the Block list. I looked to see if there was an cron job but there wasn't. Some reason I thinking there was a cron job that was based on the 'Remove blocked hosts every' field

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.