Snort failing to start after latest rules update

madscientist159

After the latest automatic rules update on 04/04/2014 Snort is failing to start with this error:
"snort.rules(9) Unknown ClassType: unsuccessful-user"

I have been running the latest version of Snort for many weeks without any errors like this being thrown. Is this a known ruleset problem or Snort problem?

bmeeks

@madscientist159:

After the latest automatic rules update on 04/04/2014 Snort is failing to start with this error:
"snort.rules(9) Unknown ClassType: unsuccessful-user"

I have been running the latest version of Snort for many weeks without any errors like this being thrown. Is this a known ruleset problem or Snort problem?

That would be a rules problem. What that error literally means is there is no entry in the classification.config file for the type "unsuccessful-user". The classification.config file comes down as part of the rules update package. Which types of rules are you using: Snort VRT, Emerging Threats, Snort GPLv2 Community or some combination of these?

Bill

madscientist159

@bmeeks:

@madscientist159:

After the latest automatic rules update on 04/04/2014 Snort is failing to start with this error:
"snort.rules(9) Unknown ClassType: unsuccessful-user"

I have been running the latest version of Snort for many weeks without any errors like this being thrown. Is this a known ruleset problem or Snort problem?

That would be a rules problem. What that error literally means is there is no entry in the classification.config file for the type "unsuccessful-user". The classification.config file comes down as part of the rules update package. Which types of rules are you using: Snort VRT, Emerging Threats, Snort GPLv2 Community or some combination of these?

Bill

Snort GPLv2 Community and Emerging Threats:
EMERGING THREATS RULES –> 25dc6a2c4441fd03150cf13b36d1affc
SNORT GPLv2 COMMUNITY RULES --> 48017199d5294952577dc22e8c3948be

Strange that no one else is noticing this if the rules are the problem. This knocked Snort offline immediately afer the automated rule update.

Thanks!

madscientist159

Never mind. It seems that if the disk usage is high enough (> 102% ?) Snort will sliently fail. :-[

I am using NanoBSD, so I was a bit surprised by this. I take it the Snort rules are not kept in tmpfs?

bmeeks

@madscientist159:

Never mind. It seems that if the disk usage is high enough (> 102% ?) Snort will sliently fail. :-[

I am using NanoBSD, so I was a bit surprised by this. I take it the Snort rules are not kept in tmpfs?
[/quote]

The rules are written to /usr/local/etc/snort (if on a 2.0.x machine) and to /usr/pbi/snort-arch/etc/snort on a 2.1 machine. If there is not enough free disk space, bad things can certainly happen.