Snort stays online for a while, then fails to start again…

mediumgrade

Snort info:
2.9.4.1
pkg v. 2.5.5

So, I can get Snort to start for a while, then it will refuse to start. When I look at the logs, I see this:

/usr/local/etc/snort/snort_11942_bge0/preproc_rules/decoder.rules(1) Unknown ClassType: protocol-command-decode

When I look into the /usr/local/etc/snort/snort_11942_bge0/ directory, I see that the classification.config is at 0 bytes. If I copy the version in /usr/local/etc/snort/ to the /usr/local/etc/snort/snort_11942_bge0/ directory, I can get it to start again. However, this file seems to go back to zero eventually and I have to do this all over again. I don't know enough about Snort to have any idea as to why this happens.

Any ideas?

eri--

You need to upgrade there is no other options to fix these issues.
Install latest snort version and these should be fixed.

bmeeks

Ermal is correct. This was an issue in earlier versions caused by a logic problem in the automatic rules update code. Under certain situations, the updating of the classification.config and reference.config files would result in empy, zero-length files. Snort definitely did not like that and would dump on the first alert detection when it tried to read the classification and/or reference information from the files to include with the log message.

The current 2.5.7 version of the Snort Package fixed this issue.

Bill

mediumgrade

So far so good. I'll let you know.

Thanks!