Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Snort 2.9.2.3 pkg v. 2.5.4 - Service Start

    Scheduled Pinned Locked Moved pfSense Packages
    12 Posts 6 Posters 2.7k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • S
      stanthewizard
      last edited by

      Hello

      I have a problem with the snort service

      Snort is accessible
      Apparently enabled on the wan with rules …etc

      BUT the service appears stopped. I'm unable to start it via the gui but ssh snort fires the service ...

      Any idea what is happening ?

      1 Reply Last reply Reply Quote 0
      • E
        eri--
        last edited by

        You have to provide a bit more information and some logs.

        1 Reply Last reply Reply Quote 0
        • S
          stanthewizard
          last edited by

          Yes what kind of info ?
          the Syslog ??

          Thanks

          1 Reply Last reply Reply Quote 0
          • E
            eri--
            last edited by

            Yep syslog and ps -ax | grep snort

            1 Reply Last reply Reply Quote 0
            • S
              stanthewizard
              last edited by

              grep returns nothing

              and the syslog is clear from anything related to snort

              1 Reply Last reply Reply Quote 0
              • S
                stanthewizard
                last edited by

                I started snort with ssh shell
                grep command returns

                26151  0- S+    0:00.26 snort

                1 Reply Last reply Reply Quote 0
                • bmeeksB
                  bmeeks
                  last edited by

                  @ermal:

                  Yep syslog and ps -ax | grep snort

                  Ermal:

                  I had a problem starting Snort on one of my virtual machines I use for testing, and the system log was empty of any useful messages.  Nothing gave me any clue why it was failing to start.  I did the standard remove/install and it started working, but I think the change you made a couple of days back to slience some of Snort's log spamming may have went a bit too far.  It appears to more or less have completely silenced Snort other than messages from the Rules Update.

                  I agree the former state was probably too much noise, but I think now we have the opposite – too little information about failures. Is there perhaps a middle ground?

                  1 Reply Last reply Reply Quote 0
                  • S
                    Supermule Banned
                    last edited by

                    I agree to the above stated! We dont have a clue when it goes down!

                    1 Reply Last reply Reply Quote 0
                    • C
                      Cino
                      last edited by

                      Dont know if this is related but noticed my lan alert interface wont start. It uses the default home netlist (my others use a custom)

                      
                      Jan 30 14:40:56 	snort[62809]: FATAL ERROR: /usr/local/etc/snort/snort_5622_em2/snort.conf(220) => Invalid ip_list to 'ignore_scanners' option.
                      
                      

                      snort.conf line 220, only a snip of it. the subnet is wrong for pfsense lan IP.

                      
                      var HOME_NET [127.0.0.1,192.168.0.1,/,68.172.xx.xx]
                      
                      
                      1 Reply Last reply Reply Quote 0
                      • S
                        stanthewizard
                        last edited by

                        I don't have a bad start or anything else.

                        I'm unable to start snort via the GUI.
                        Everything is fine with a terminal start.

                        When I stop snort via the GUI … PFsense become unresponsive

                        1 Reply Last reply Reply Quote 0
                        • D
                          derim422
                          last edited by

                          Sometimes it looks like it isn't started when it actually is, also. I found the icon in "services" to be the correct one, regardless of whether or not the icon in "interfaces" is correct. I think supermule and I discussed this in a previous thread with someone else who fixed this issue, but none of the changes have been pushed into the package yet.

                          1 Reply Last reply Reply Quote 0
                          • S
                            stanthewizard
                            last edited by

                            The icon in service is red for me unless I start snort in terminal

                            1 Reply Last reply Reply Quote 0
                            • First post
                              Last post
                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.