Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Rules Download with Snort 2.9.4.6 pkg v2.6.0 / pfsense 2.1

    Scheduled Pinned Locked Moved pfSense Packages
    7 Posts 3 Posters 4.1k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • J
      java007md
      last edited by

      I recently updated to 2.1, followed by an updated to snort. The system is performing smoothly, however rules are not being updated automatically. I tried reinstalling snort with no change. Changing the frequency of the updates 6HRs/12HRs has not effect (still no auto updating).

      Manually updating rules works fine.

      Automatic rules downloads worked fine under the previous version of pfsense/snort.

      Any suggestions for troubleshooting/resolving would be appreciated.

      Thanks!

      1 Reply Last reply Reply Quote 0
      • F
        fragged
        last edited by

        Looking at Snort.org it seems like the last Snort VRT rules upgrade is from 26th. I manually hit the update button this morning and there was a update for ET rules. The log suggest that auto updates are working, but there was nothing to update.

        What does the update log look like for you?

        1 Reply Last reply Reply Quote 0
        • J
          java007md
          last edited by

          recent log entries are below:

          Starting rules update…  Time: 2013-09-21 16:05:06
          Downloading Snort VRT md5 file...
          Checking Snort VRT md5 file...
          Snort VRT rules are up to date.
          The Rules update has finished.  Time: 2013-09-21 16:05:07

          Starting rules update...  Time: 2013-09-24 21:02:14
          Downloading Snort VRT md5 file...
          Checking Snort VRT md5 file...
          There is a new set of Snort VRT rules posted. Downloading...
          Done downloading rules file.
          Extracting and installing Snort VRT rules...
          Using Snort VRT precompiled SO rules for FreeBSD-8-1 ...
          Installation of Snort VRT rules completed.
          Copying new config and map files...
          Updating rules configuration for: WAN ...
          Updating rules configuration for: LAN1 ...
          Updating rules configuration for: LAN2 ...
          Restarting Snort to activate the new set of rules...
          Snort has restarted with your new set of rules.
          The Rules update has finished.  Time: 2013-09-24 21:03:20

          Starting rules update...  Time: 2013-09-26 23:41:14
          Downloading Snort VRT md5 file...
          Checking Snort VRT md5 file...
          There is a new set of Snort VRT rules posted. Downloading...
          Done downloading rules file.
          Extracting and installing Snort VRT rules...
          Using Snort VRT precompiled SO rules for FreeBSD-8-1 ...
          Installation of Snort VRT rules completed.
          Copying new config and map files...
          Updating rules configuration for: WAN ...
          Updating rules configuration for: LAN1 ...
          Updating rules configuration for: LAN2 ...
          Restarting Snort to activate the new set of rules...
          Snort has restarted with your new set of rules.
          The Rules update has finished.  Time: 2013-09-26 23:41:48

          Starting rules update...  Time: 2013-09-28 00:06:01
          Downloading Snort VRT md5 file 'snortrules-snapshot-2946.tar.gz.md5'...
          Snort VRT md5 download failed.
          Server returned error code '504'.
          Snort VRT rules will not be updated.
          The Rules update has finished.  Time: 2013-09-28 00:07:28

          Starting rules update...  Time: 2013-09-28 00:10:05
          Downloading Snort VRT md5 file 'snortrules-snapshot-2946.tar.gz.md5'...
          Checking Snort VRT md5 file...
          Snort VRT rules are up to date.
          The Rules update has finished.  Time: 2013-09-28 00:10:57

          Starting rules update...  Time: 2013-09-29 00:54:29
          Downloading Snort VRT md5 file 'snortrules-snapshot-2946.tar.gz.md5'...
          Checking Snort VRT md5 file...
          Snort VRT rules are up to date.
          The Rules update has finished.  Time: 2013-09-29 00:54:30

          Starting rules update...  Time: 2013-09-29 10:35:34
          Downloading Snort VRT md5 file 'snortrules-snapshot-2946.tar.gz.md5'...
          Checking Snort VRT md5 file...
          Snort VRT rules are up to date.
          The Rules update has finished.  Time: 2013-09-29 10:35:35

          Starting rules update...  Time: 2013-09-30 20:37:54
          Downloading Snort VRT md5 file 'snortrules-snapshot-2946.tar.gz.md5'...
          Checking Snort VRT md5 file...
          Snort VRT rules are up to date.
          The Rules update has finished.  Time: 2013-09-30 20:37:55


          Those were all manual updates. Under the previous snort version, the automatic attempts were showing up as well.

          1 Reply Last reply Reply Quote 0
          • bmeeksB
            bmeeks
            last edited by

            There are usually only two updates per week.  You can check the actual Snort site to verify.  There was a new update posted today (October 1).  They generally update on Tuesday and Thursday afternoons.

            I have personally found that updates are more reliable if you set the start time to 1:00 AM or later.  My suspicion is some backup or maintenance process on the Snort VRT servers frequently interferes with updates too close to midnight.

            Bill

            1 Reply Last reply Reply Quote 0
            • J
              java007md
              last edited by

              Thank you Bill. I changed the update time to 0203 and will give it a week to see if the update actually occurs. If not, manual updates are not that much of a burden.

              1 Reply Last reply Reply Quote 0
              • bmeeksB
                bmeeks
                last edited by

                @java007md:

                Thank you Bill. I changed the update time to 0203 and will give it a week to see if the update actually occurs. If not, manual updates are not that much of a burden.

                The auto updates should "just work".  The only problem I encountered was back when mine were set for 00:03.  That was the old default in the package, and those would fail quite often for me (the Snort VRT updates, that is).  That's the main reason I added the option to choose other update start times.  Once I moved to something more than an hour past midnight, I have not had another problem.

                I don't remember ever having a problem with the Emerging Threats updates.

                Bill

                1 Reply Last reply Reply Quote 0
                • J
                  java007md
                  last edited by

                  To close this out (hopefully), the problem resolved itself after a power outage and restart of the pfsense box. Auto downloads appear to be working fine as expected. Thanks!

                  1 Reply Last reply Reply Quote 0
                  • First post
                    Last post
                  Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.