Snort stays online for a while, then fails to start again…



  • Snort info:
    2.9.4.1
    pkg v. 2.5.5

    So, I can get Snort to start for a while, then it will refuse to start. When I look at the logs, I see this:

    /usr/local/etc/snort/snort_11942_bge0/preproc_rules/decoder.rules(1) Unknown ClassType: protocol-command-decode
    

    When I look into the /usr/local/etc/snort/snort_11942_bge0/ directory, I see that the classification.config is at 0 bytes. If I copy the version in /usr/local/etc/snort/ to the /usr/local/etc/snort/snort_11942_bge0/ directory, I can get it to start again. However, this file seems to go back to zero eventually and I have to do this all over again. I don't know enough about Snort to have any idea as to why this happens.

    Any ideas?



  • You need to upgrade there is no other options to fix these issues.
    Install latest snort version and these should be fixed.



  • Ermal is correct.  This was an issue in earlier versions caused by a logic problem in the automatic rules update code.  Under certain situations, the updating of the classification.config and reference.config files would result in empy, zero-length files.  Snort definitely did not like that and would dump on the first alert detection when it tried to read the classification and/or reference information from the files to include with the log message.

    The current 2.5.7 version of the Snort Package fixed this issue.

    Bill



  • So far so good. I'll let you know.

    Thanks!


Log in to reply