Rules Download with Snort 2.9.4.6 pkg v2.6.0 / pfsense 2.1

[java007md]

I recently updated to 2.1, followed by an updated to snort. The system is performing smoothly, however rules are not being updated automatically. I tried reinstalling snort with no change. Changing the frequency of the updates 6HRs/12HRs has not effect (still no auto updating).

Manually updating rules works fine.

Automatic rules downloads worked fine under the previous version of pfsense/snort.

Any suggestions for troubleshooting/resolving would be appreciated.

Thanks!

[fragged]

Looking at Snort.org it seems like the last Snort VRT rules upgrade is from 26th. I manually hit the update button this morning and there was a update for ET rules. The log suggest that auto updates are working, but there was nothing to update.

What does the update log look like for you?

[java007md]

recent log entries are below:

Starting rules update…  Time: 2013-09-21 16:05:06
Downloading Snort VRT md5 file...
Checking Snort VRT md5 file...
Snort VRT rules are up to date.
The Rules update has finished.  Time: 2013-09-21 16:05:07

Starting rules update...  Time: 2013-09-24 21:02:14
Downloading Snort VRT md5 file...
Checking Snort VRT md5 file...
There is a new set of Snort VRT rules posted. Downloading...
Done downloading rules file.
Extracting and installing Snort VRT rules...
Using Snort VRT precompiled SO rules for FreeBSD-8-1 ...
Installation of Snort VRT rules completed.
Copying new config and map files...
Updating rules configuration for: WAN ...
Updating rules configuration for: LAN1 ...
Updating rules configuration for: LAN2 ...
Restarting Snort to activate the new set of rules...
Snort has restarted with your new set of rules.
The Rules update has finished.  Time: 2013-09-24 21:03:20

Starting rules update...  Time: 2013-09-26 23:41:14
Downloading Snort VRT md5 file...
Checking Snort VRT md5 file...
There is a new set of Snort VRT rules posted. Downloading...
Done downloading rules file.
Extracting and installing Snort VRT rules...
Using Snort VRT precompiled SO rules for FreeBSD-8-1 ...
Installation of Snort VRT rules completed.
Copying new config and map files...
Updating rules configuration for: WAN ...
Updating rules configuration for: LAN1 ...
Updating rules configuration for: LAN2 ...
Restarting Snort to activate the new set of rules...
Snort has restarted with your new set of rules.
The Rules update has finished.  Time: 2013-09-26 23:41:48

Starting rules update...  Time: 2013-09-28 00:06:01
Downloading Snort VRT md5 file 'snortrules-snapshot-2946.tar.gz.md5'...
Snort VRT md5 download failed.
Server returned error code '504'.
Snort VRT rules will not be updated.
The Rules update has finished.  Time: 2013-09-28 00:07:28

Starting rules update...  Time: 2013-09-28 00:10:05
Downloading Snort VRT md5 file 'snortrules-snapshot-2946.tar.gz.md5'...
Checking Snort VRT md5 file...
Snort VRT rules are up to date.
The Rules update has finished.  Time: 2013-09-28 00:10:57

Starting rules update...  Time: 2013-09-29 00:54:29
Downloading Snort VRT md5 file 'snortrules-snapshot-2946.tar.gz.md5'...
Checking Snort VRT md5 file...
Snort VRT rules are up to date.
The Rules update has finished.  Time: 2013-09-29 00:54:30

Starting rules update...  Time: 2013-09-29 10:35:34
Downloading Snort VRT md5 file 'snortrules-snapshot-2946.tar.gz.md5'...
Checking Snort VRT md5 file...
Snort VRT rules are up to date.
The Rules update has finished.  Time: 2013-09-29 10:35:35

Starting rules update...  Time: 2013-09-30 20:37:54
Downloading Snort VRT md5 file 'snortrules-snapshot-2946.tar.gz.md5'...
Checking Snort VRT md5 file...
Snort VRT rules are up to date.
The Rules update has finished.  Time: 2013-09-30 20:37:55

---

Those were all manual updates. Under the previous snort version, the automatic attempts were showing up as well.

[bmeeks]

There are usually only two updates per week.  You can check the actual Snort site to verify.  There was a new update posted today (October 1).  They generally update on Tuesday and Thursday afternoons.

I have personally found that updates are more reliable if you set the start time to 1:00 AM or later.  My suspicion is some backup or maintenance process on the Snort VRT servers frequently interferes with updates too close to midnight.

Bill

[java007md]

Thank you Bill. I changed the update time to 0203 and will give it a week to see if the update actually occurs. If not, manual updates are not that much of a burden.

[bmeeks]

@java007md:

Thank you Bill. I changed the update time to 0203 and will give it a week to see if the update actually occurs. If not, manual updates are not that much of a burden.

The auto updates should "just work".  The only problem I encountered was back when mine were set for 00:03.  That was the old default in the package, and those would fail quite often for me (the Snort VRT updates, that is).  That's the main reason I added the option to choose other update start times.  Once I moved to something more than an hour past midnight, I have not had another problem.

I don't remember ever having a problem with the Emerging Threats updates.

Bill

[java007md]

To close this out (hopefully), the problem resolved itself after a power outage and restart of the pfsense box. Auto downloads appear to be working fine as expected. Thanks!