Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Snort Won't Start After Upgrade

    pfSense Packages
    64
    301
    187.2k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • B
      berglundma
      last edited by

      I too am having the same issue. Based on the number of reads I'm thinking we're not alone.

      1 Reply Last reply Reply Quote 0
      • D
        dwood
        last edited by

        Same thing here on a new install:

        Version:
        2.0-RC3 (amd64)
        built on Tue Jun 21 23:37:22 EDT 2011

        Intel(R) Atom(TM) CPU 330 @ 1.60GHz
        Current: 799 MHz, Max: 1599 MHz

        When starting Snort:
        snort[26473]: FATAL ERROR: /usr/local/etc/snort/snort_31943_re1/snort.conf(351) Unknown output plugin: "alert_pf"

        Cheers,
        D.

        1 Reply Last reply Reply Quote 0
        • A
          asterix
          last edited by

          The Snort package is broken since over 2 weeks now. First I thought it was a snapshot issue but after trying multiple snapshots, I confirmed it's a snort package issue.

          1 Reply Last reply Reply Quote 0
          • D
            dwood
            last edited by

            With a clean RC3 install, the error message is now different than with RC2

            Clean RC2 install:
            snort[26473]: FATAL ERROR: /usr/local/etc/snort/snort_31943_re1/snort.conf(351) Unknown output plugin: "alert_pf"

            Clean RC3 install:
            Jun 23 01:50:39 SnortStartup[5379]: Snort HARD Reload For 22075_re1…
            Jun 23 01:50:38 SnortStartup[1825]: Snort Startup files Sync…

            Is there a method to "manually" install a newer version of snort without using the package?  Looking at various dates on the "JamesDean" twitter feeds, the last update was on Mar 16, indicating 2.9.0.4 was due in a few days.  This being June, safe bet that "jamesdean" is otherwise occupied…so would love to figure out a fix that doesn't use the package if that is at all possible.

            Btw, I've been posting my adventures (including a hardware list and various notes) with pfSense over at smallnetbuilder:  http://forums.smallnetbuilder.com/showthread.php?t=5379

            1 Reply Last reply Reply Quote 0
            • A
              asterix
              last edited by

              Any progress on this issue resolution?

              1 Reply Last reply Reply Quote 0
              • P
                psgandalf
                last edited by

                I upgraded to built on Mon Jun 27 06:38:49 EDT 2011 on my Alix board.
                Before I deleted the interface and reset snort. After the upgrade Snort
                started but I wasn't able to choose any rules even thoug the update went
                well. But after stopping the interface and restarting it the rules where ther
                to choose from. Back in business  ;D

                1 Reply Last reply Reply Quote 0
                • A
                  asterix
                  last edited by

                  Tried that. Doesn't work for me.

                  1 Reply Last reply Reply Quote 0
                  • J
                    jamesdean
                    last edited by

                    I am updating snort-dev binaries, I have to remove snort from pfsense packages 2.0 x86 for a day or two. Its broken anyway.

                    The new GUI is done, Im on the last strep, that is setting up pfSense ports to build binaries automatically.

                    1 Reply Last reply Reply Quote 0
                    • D
                      dwood
                      last edited by

                      Thanks for the update.  I'd guess AMD64 is next?

                      I know the time committment required to do the work you're doing.  I'm sure I speak for literally 1000s when I say thanks for your efforts :-)  I'm a recent pfsense convert and despite the current bugs, still loving it.

                      Cheers,
                      Dennis.

                      1 Reply Last reply Reply Quote 0
                      • _
                        _igor_
                        last edited by

                        Thanks, jamesdean, that sounds great! Take your time to fix your issues. Great job you do with this great package!

                        1 Reply Last reply Reply Quote 0
                        • S
                          sporkpdx
                          last edited by

                          I am also running into this.

                          I have managed to copy a working package over from a pfsense 1.2.3 install for the timebeing but I'm hoping this gets fixed for 2.0 x64 asap, I'll owe ya a beer. :)

                          1 Reply Last reply Reply Quote 0
                          • J
                            james.dean
                            last edited by

                            @jamesdean:

                            I am updating snort-dev binaries, I have to remove snort from pfsense packages 2.0 x86 for a day or two. Its broken anyway.

                            The new GUI is done, Im on the last strep, that is setting up pfSense ports to build binaries automatically.

                            Thank you for your effort. Extended to 5 days now?

                            Did you mean for a week or two? The standard snort package was not broken.. may be the snort-dev package. Now I can install the broken snort-dev package but not the working snort package.. well  ::)

                            1 Reply Last reply Reply Quote 0
                            • A
                              amrogers3
                              last edited by

                              @james.dean:

                              Did you mean for a week or two? The standard snort package was not broken.. may be the snort-dev package. Now I can install the broken snort-dev package but not the working snort package.. well  ::)

                              You got the snort-dev package to work?

                              1 Reply Last reply Reply Quote 0
                              • J
                                james.dean
                                last edited by

                                @amrogers3:

                                @james.dean:

                                Did you mean for a week or two? The standard snort package was not broken.. may be the snort-dev package. Now I can install the broken snort-dev package but not the working snort package.. well  ::)

                                You got the snort-dev package to work?

                                What from the standard snort package was not broken may be the snort-dev package (is) didn't you understand?  ::) Two weeks ago I could download the standard package and it worked.. no for my freshly flashed device I cannot longer install the standard package just because of some GUI improvements? I thought the snort-dev was for testing.. not the standard one.. we will wait another week or two..

                                1 Reply Last reply Reply Quote 0
                                • JSmoradaJ
                                  JSmorada
                                  last edited by

                                  Now I'm totally confused so I'll try to phrase this in a way that is easy to understand…

                                  I just upgraded from release 1.2.3 with SNORT installed and running to release to 2.0-RC3 built on Mon Jul 4 16:48:37 EDT 2011.

                                  Snort was not installed or running; which isn't a big deal.

                                  When I go to the system/packages menu, it Snort isn't listed as an available package. Snort-dev is, but is shown as unstable and I would rather eat broken glass than install anything that's "unstable".

                                  My question is, "What happened to the stable version of Snort?" It was available the last time I tried pfSense 2.0. If it's not available through the "available packages" is there a way to get a working copy manually outside of the package manager?

                                  1 Reply Last reply Reply Quote 0
                                  • C
                                    Cino
                                    last edited by

                                    The dev took it down since there are issues with it installing on 2.0 boxes that never had snort installed on it. I can't speak for the dev, but since he is trying to release a new verison for 2.0; it doesn't make sense to fix the old version. I would rather him finish coding the new then fix the old..

                                    1 Reply Last reply Reply Quote 0
                                    • H
                                      hansmuff
                                      last edited by

                                      @james.dean:

                                      What from the standard snort package was not broken may be the snort-dev package (is) didn't you understand?  ::) Two weeks ago I could download the standard package and it worked.. no for my freshly flashed device I cannot longer install the standard package just because of some GUI improvements? I thought the snort-dev was for testing.. not the standard one.. we will wait another week or two..

                                      I thought 2.0 is only being put out as a Release Candidate, meaning things like this are to be expected.

                                      1 Reply Last reply Reply Quote 0
                                      • J
                                        james.dean
                                        last edited by

                                        @hansmuff:

                                        @james.dean:

                                        What from the standard snort package was not broken may be the snort-dev package (is) didn't you understand?  ::) Two weeks ago I could download the standard package and it worked.. no for my freshly flashed device I cannot longer install the standard package just because of some GUI improvements? I thought the snort-dev was for testing.. not the standard one.. we will wait another week or two..

                                        I thought 2.0 is only being put out as a Release Candidate, meaning things like this are to be expected.

                                        It was stated somewhere the RC3 will be almost the final version but this has nothing to do with the snort package itself. For me the snort package worked on a newly installed RC3 but now the package has gone, and I relalized my love was so strong, …  ;D

                                        1 Reply Last reply Reply Quote 0
                                        • H
                                          hansmuff
                                          last edited by

                                          @james.dean:

                                          It was stated somewhere the RC3 will be almost the final version but this has nothing to do with the snort package itself. For me the snort package worked on a newly installed RC3 but now the package has gone, and I relalized my love was so strong, …  ;D

                                          And how can anyone say that love is wrong  :D
                                          I'm with you man, not having snort is painful. Give the dev/maintainer (apologies, not sure which in this case) some time, I think we're in for a really nice treat.

                                          1 Reply Last reply Reply Quote 0
                                          • J
                                            jamesdean
                                            last edited by

                                            Sorry for the confusion from my last post. I will try to explain again why its taking so long.
                                            I removed the snort package from pfSense 2.0 because I need no binary conflicts with snort-dev binarries.

                                            I have been asked by the senior pfSense devs to make my binaries compile automatically on the pfSense.org servers.

                                            Right now they are compiling with errors and I have to wait until someone that has access to pfSense.org servers can help me.
                                            The senior devs are all busy with a project.

                                            Please be patient, I have been working really hard to make the new snort-dev.

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post