Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Snort crashes on update

    Scheduled Pinned Locked Moved IDS/IPS
    7 Posts 5 Posters 2.1k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • F
      foresthus
      last edited by

      Hello,

      I have a problem when I updated to the new SNORT. This is the failure:

      Crash report begins.  Anonymous machine information:

      amd64
      10.1-RELEASE-p15
      FreeBSD 10.1-RELEASE-p15 #0 c5ab052(releng/10.1)-dirty: Sat Jul 25 20:20:58 CDT 2015    root@pfs22-amd64-builder:/usr/obj.amd64/usr/pfSensesrc/src/sys/pfSense_SMP.10

      Crash report details:

      PHP Errors:
      [28-Aug-2015 14:09:21 Europe/Berlin] PHP Fatal error:  require(): Failed opening required '/usr/local/pkg/snort/snort_defs.inc' (include_path='.:/etc/inc:/usr/local/www:/usr/local/captiveportal:/usr/local/pkg') in /usr/local/pkg/snort/snort.inc on line 40
      [28-Aug-2015 14:15:26 Europe/Berlin] PHP Fatal error:  require(): Failed opening required '/usr/local/pkg/snort/snort_defs.inc' (include_path='.:/etc/inc:/usr/local/www:/usr/local/captiveportal:/usr/local/pkg') in /usr/local/pkg/snort/snort.inc on line 40
      
      Filename: /var/crash/minfree
      2048
      

      What can I do?

      1 Reply Last reply Reply Quote 0
      • D
        doktornotor Banned
        last edited by

        Reinstall the package again so that the required file is not missing?

        1 Reply Last reply Reply Quote 0
        • bmeeksB
          bmeeks
          last edited by

          The @dok is correct.  You have one or more missing files in your Snort installation.  Try going to System…Packages and click the XML icon on the Installed Packages tab beside Snort to re-install the GUI package components for Snort.

          Post back if the issue continues.

          Bill

          1 Reply Last reply Reply Quote 0
          • F
            foresthus
            last edited by

            @bmeeks:

            The @dok is correct.  You have one or more missing files in your Snort installation.  Try going to System…Packages and click the XML icon on the Installed Packages tab beside Snort to re-install the GUI package components for Snort.

            Post back if the issue continues.

            Bill

            No is did not work. So I decided to restore one o fmy backups befor the update came. That helped, bur reinstall or just reinstall the GUI package did not help.

            After the restore everything was ok again. I was able to send the crashreport, what I did.

            cu

            1 Reply Last reply Reply Quote 0
            • H
              hulleyrob
              last edited by

              I had something similar on the last update wouldn't start then wouldn't remove or reinstall.

              Reinstall guy followed by reinstall worked for me but it does look like the last update has caused a few problems.

              Rob

              1 Reply Last reply Reply Quote 0
              • T
                themaninspain
                last edited by

                Well I've got it again today this time it's a different module:

                snort[68706]: FATAL ERROR: Failed to load /usr/pbi/snort-amd64/lib/snort_dynamicrules/pua-p2p.so: /usr/pbi/snort-amd64/local/lib/snort_dynamicrules/pua-p2p.so: invalid file format
                Which is interesting because I don't have this ruleset activated.

                and

                snort[14720]: FATAL ERROR: Failed to load /usr/pbi/snort-amd64/lib/snort_dynamicrules/protocol-voip.so: /usr/pbi/snort-amd64/local/lib/snort_dynamicrules/protocol-voip.so: Shared object has no run-time symbol table

                no idea on this one.

                Any ideas on what's going on? I can't believe that snort rule updates are this flaky so there must be another problem causing this.

                Alan

                1 Reply Last reply Reply Quote 0
                • D
                  doktornotor Banned
                  last edited by

                  Perhaps you should just stop updating the rules until upstream guys come back to senses. Already reported by someone else as well with different .so - see https://forum.pfsense.org/index.php?topic=98920.0

                  1 Reply Last reply Reply Quote 0
                  • First post
                    Last post
                  Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.