pfSense Gold Subscription

« previous next »
Pages: 1 2 3 [4] 5 6 7   Go Down

Author Topic: snort problem  (Read 21680 times)

0 Members and 1 Guest are viewing this topic.

Offline ColdFusion

  • Full Member
  • ***
  • Posts: 168
  • Karma: +0/-0
    • View Profile
Re: snort problem
« Reply #45 on: May 26, 2009, 05:45:03 am »
seems to work now, no errors in log.

thanks for the update..

John
Logged

Offline simonchs

  • Newbie
  • *
  • Posts: 18
  • Karma: +0/-0
    • View Profile
Re: snort problem
« Reply #46 on: May 26, 2009, 06:06:59 am »
i've just reinstalled twice the snort package, but i can't start-up the snort service, here are the log:

May 26 18:35:47 xxxxx snort[23564]: Initializing daemon mode
May 26 18:35:47 xxxxx snort[23564]: Initializing daemon mode
May 26 18:35:47 xxxxx snort[23567]: PID path stat checked out ok, PID path set to /var/run/
May 26 18:35:47 xxxxx snort[23567]: PID path stat checked out ok, PID path set to /var/run/
May 26 18:35:47 xxxxx snort[23567]: FATAL ERROR: Failed to Lock PID File "/var/run//snort_em1.pid" for PID "23567"
May 26 18:35:47 xxxxx snort[23567]: FATAL ERROR: Failed to Lock PID File "/var/run//snort_em1.pid" for PID "23567"
May 26 18:35:48 xxxxx snort[23564]: Child exited unexpectedly
May 26 18:35:48 xxxxx snort[23564]: Child exited unexpectedly
May 26 18:35:48 xxxxx snort[23564]: Daemon parent exiting
May 26 18:35:48 xxxxx snort[23564]: Daemon parent exiting
May 26 18:35:56 xxxxx snort2c[23647]: snort2c running in daemon mode pid: 23647
May 26 18:35:56 xxxxx snort2c[23647]: snort2c running in daemon mode pid: 23647
May 26 18:36:13 xxxxx SnortStartup[23667]: Ram free BEFORE starting Snort: 59M -- Ram free AFTER starting Snort: 59M -- Mode ac-bnfa -- Snort memory usage:


i've tried to stop the snort service, remove the file /var/run/snort_em1.pid.lck and start the snort service again, and even reboot my pfsense, but got the same log as above.

any trick?
Logged

Offline ColdFusion

  • Full Member
  • ***
  • Posts: 168
  • Karma: +0/-0
    • View Profile
Re: snort problem
« Reply #47 on: May 26, 2009, 11:48:39 am »
Did you update the rules at all after installation? If not update..should start.
Logged

Offline NotSure

  • Full Member
  • ***
  • Posts: 299
  • Karma: +0/-0
    • View Profile
Re: snort problem
« Reply #48 on: May 26, 2009, 12:30:07 pm »
Seems to be working great on pfs 1.2.3 w/dual wan & CP, thanks for the update.

Slam
Logged

Offline jamesdean

  • Global Moderator
  • Sr. Member
  • *****
  • Posts: 352
  • Karma: +0/-0
    • View Profile
Re: snort problem
« Reply #49 on: May 26, 2009, 02:06:43 pm »
Quote from: simonchs on May 26, 2009, 06:06:59 am
i've just reinstalled twice the snort package, but i can't start-up the snort service, here are the log:

May 26 18:35:47 xxxxx snort[23564]: Initializing daemon mode
May 26 18:35:47 xxxxx snort[23564]: Initializing daemon mode
May 26 18:35:47 xxxxx snort[23567]: PID path stat checked out ok, PID path set to /var/run/
May 26 18:35:47 xxxxx snort[23567]: PID path stat checked out ok, PID path set to /var/run/
May 26 18:35:47 xxxxx snort[23567]: FATAL ERROR: Failed to Lock PID File "/var/run//snort_em1.pid" for PID "23567"
May 26 18:35:47 xxxxx snort[23567]: FATAL ERROR: Failed to Lock PID File "/var/run//snort_em1.pid" for PID "23567"
May 26 18:35:48 xxxxx snort[23564]: Child exited unexpectedly
May 26 18:35:48 xxxxx snort[23564]: Child exited unexpectedly
May 26 18:35:48 xxxxx snort[23564]: Daemon parent exiting
May 26 18:35:48 xxxxx snort[23564]: Daemon parent exiting
May 26 18:35:56 xxxxx snort2c[23647]: snort2c running in daemon mode pid: 23647
May 26 18:35:56 xxxxx snort2c[23647]: snort2c running in daemon mode pid: 23647
May 26 18:36:13 xxxxx SnortStartup[23667]: Ram free BEFORE starting Snort: 59M -- Ram free AFTER starting Snort: 59M -- Mode ac-bnfa -- Snort memory usage:


i've tried to stop the snort service, remove the file /var/run/snort_em1.pid.lck and start the snort service again, and even reboot my pfsense, but got the same log as above.

any trick?



If any of you are still having problems. Please fallow these steps.

1. Reinstall snort. (So that the new code gets updated.)

2. Deinstall snort. (New code deinstalls all the old snort packages.)

3. Install the snort package.

4. Update the rules.

Finished, snort should work now.


James
« Last Edit: May 26, 2009, 02:08:24 pm by jamesdean »
Logged
PLease post your Pfsense Version and Snort Version when asking questions. Thank you.

Offline simonchs

  • Newbie
  • *
  • Posts: 18
  • Karma: +0/-0
    • View Profile
Re: snort problem
« Reply #50 on: May 26, 2009, 11:41:56 pm »
Quote from: ColdFusion on May 26, 2009, 11:48:39 am
Did you update the rules at all after installation? If not update..should start.

yes, i've update the rules once the install/re-install complete.
Logged

Offline simonchs

  • Newbie
  • *
  • Posts: 18
  • Karma: +0/-0
    • View Profile
Re: snort problem
« Reply #51 on: May 26, 2009, 11:47:31 pm »
Quote from: jamesdean on May 26, 2009, 02:06:43 pm
Quote from: simonchs on May 26, 2009, 06:06:59 am
i've just reinstalled twice the snort package, but i can't start-up the snort service, here are the log:

May 26 18:35:47 xxxxx snort[23564]: Initializing daemon mode
May 26 18:35:47 xxxxx snort[23564]: Initializing daemon mode
May 26 18:35:47 xxxxx snort[23567]: PID path stat checked out ok, PID path set to /var/run/
May 26 18:35:47 xxxxx snort[23567]: PID path stat checked out ok, PID path set to /var/run/
May 26 18:35:47 xxxxx snort[23567]: FATAL ERROR: Failed to Lock PID File "/var/run//snort_em1.pid" for PID "23567"
May 26 18:35:47 xxxxx snort[23567]: FATAL ERROR: Failed to Lock PID File "/var/run//snort_em1.pid" for PID "23567"
May 26 18:35:48 xxxxx snort[23564]: Child exited unexpectedly
May 26 18:35:48 xxxxx snort[23564]: Child exited unexpectedly
May 26 18:35:48 xxxxx snort[23564]: Daemon parent exiting
May 26 18:35:48 xxxxx snort[23564]: Daemon parent exiting
May 26 18:35:56 xxxxx snort2c[23647]: snort2c running in daemon mode pid: 23647
May 26 18:35:56 xxxxx snort2c[23647]: snort2c running in daemon mode pid: 23647
May 26 18:36:13 xxxxx SnortStartup[23667]: Ram free BEFORE starting Snort: 59M -- Ram free AFTER starting Snort: 59M -- Mode ac-bnfa -- Snort memory usage:


i've tried to stop the snort service, remove the file /var/run/snort_em1.pid.lck and start the snort service again, and even reboot my pfsense, but got the same log as above.

any trick?



If any of you are still having problems. Please fallow these steps.

1. Reinstall snort. (So that the new code gets updated.)

2. Deinstall snort. (New code deinstalls all the old snort packages.)

3. Install the snort package.

4. Update the rules.

Finished, snort should work now.


James

thanks James, still no luck, same log shown as above post. the "snort" can't start while the "snort2c" can run.
Logged

Offline simonchs

  • Newbie
  • *
  • Posts: 18
  • Karma: +0/-0
    • View Profile
Re: snort problem
« Reply #52 on: May 27, 2009, 01:17:40 am »
i've just modified /usr/local/etc/rc.d/snort.sh and changed:
snort -c /usr/local/etc/snort/snort.conf -l /var/log/snort -D -i em1 -A fast -q
to:
snort -c /usr/local/etc/snort/snort.conf -l /var/log/snort -i em1 -A fast -q &
then the snort work properly

is there any way to trace the problem?

thanks.
Logged

Offline firbc

  • Jr. Member
  • **
  • Posts: 61
  • Karma: +0/-0
    • View Profile
Re: snort problem
« Reply #53 on: May 27, 2009, 01:30:27 am »
I have similar problem:

snort[1317]: FATAL ERROR: Failed to Lock PID File "/var/run//snort_xl0.pid" for PID "1317"
snort[1317]: FATAL ERROR: Failed to Lock PID File "/var/run//snort_xl0.pid" for PID "1317"

Also snort do not work after reboot. It starts, it is also loaded to memory but not working.  I have to clean alert logs and after that snort restart itself and then start to work.
Logged

Offline jamesdean

  • Global Moderator
  • Sr. Member
  • *****
  • Posts: 352
  • Karma: +0/-0
    • View Profile
Re: snort problem
« Reply #54 on: May 27, 2009, 02:02:22 am »
Hey firbc, simonchs..

Can you guys tell me what version of pfsense your running. I have a feeling its 1.2 and not 1.2.3.

Also, please tell me whats the output of "pkg_info".


Help me help you.
james
Logged
PLease post your Pfsense Version and Snort Version when asking questions. Thank you.

Offline simonchs

  • Newbie
  • *
  • Posts: 18
  • Karma: +0/-0
    • View Profile
Re: snort problem
« Reply #55 on: May 27, 2009, 02:29:46 am »
running pfsense 1.2.2

and the output of pkg_info:

arc-5.21o_1         Create & extract files from DOS .ARC files
arj-3.10.22_1       Open-source ARJ
bandwidthd-2.0.1_1  Tracks bandwidth usage by IP address
clamav-0.93.1_2     Command line virus scanner written entirely in C
gd-2.0.35,1         A graphics library for fast creation of images
havp-0.88           HTTP Antivirus Proxy
jpeg-6b_4           IJG's jpeg compression utilities
lha-1.14i_6         Archive files using LZSS and Huffman compression (.lzh file
libdnet-1.11_3      A simple interface to low level networking routines
libgmp-4.2.2        A free library for arbitrary precision arithmetic
libiconv-1.11_1     A character set conversion library
lightsquid-1.7.1_1  A light and fast web based squid proxy traffic analyser
mysql-client-5.1.34 Multithreaded SQL database (client)
openldap-client-2.4.10 Open source LDAP client implementation
openldap-client-2.4.11 Open source LDAP client implementation
p5-GD-2.39          A perl5 interface to Gd Graphics Library version2
pcre-7.9            Perl Compatible Regular Expressions library
perl-5.8.8_1        Practical Extraction and Report Language
snort-2.8.4.1       Lightweight network intrusion detection system
squid-2.6.21        HTTP Caching Proxy
squid_radius_auth-1.10 RADIUS authenticator for squid proxy 2.5 and later
unzoo-4.4_2         A zoo archive extractor

Logged

Offline jamesdean

  • Global Moderator
  • Sr. Member
  • *****
  • Posts: 352
  • Karma: +0/-0
    • View Profile
Re: snort problem
« Reply #56 on: May 27, 2009, 02:37:37 am »
Simochs

Your setup looks fine.

Have you tryed this.
Type this in the terminal "rm -r /var/run/snort*"

Restart snort.

If snort still fails type this in so that I can have a better output of the error.

"snort -c /usr/local/etc/snort/snort.conf -l /var/log/snort -v -i ng0 -A fast"


Help me help you
James
« Last Edit: May 27, 2009, 02:54:05 am by jamesdean »
Logged
PLease post your Pfsense Version and Snort Version when asking questions. Thank you.

Offline simonchs

  • Newbie
  • *
  • Posts: 18
  • Karma: +0/-0
    • View Profile
Re: snort problem
« Reply #57 on: May 27, 2009, 03:20:53 am »
yes, i've tried "rm -r /var/run/snort*" and restart snort, still failed.

when i type "snort -c /usr/local/etc/snort/snort.conf -l /var/log/snort -v -i ng0 -A fast", snort keep running and do not have error. as my previous modify to /usr/local/etc/rc.d/snort.sh, i can run snort without -D parameter.

so i guess the snort binary cannot "daemonize" itself?
Logged

Offline jamesdean

  • Global Moderator
  • Sr. Member
  • *****
  • Posts: 352
  • Karma: +0/-0
    • View Profile
Re: snort problem
« Reply #58 on: May 27, 2009, 03:38:01 am »
That is a realy wierd error ? I have never seen a error in snort were -D is the cause.

What version of 1.2.2 do you have scmochs ?

Right now Im runing 1.2.3. So im going to have to install 1.2 and retest snort.
Then im going to install all your packages and try to reproduce your error.

If there are no errors when I install pfsense 1.2 with the new snort package then you need a fresh install, mabe pfsense 1.2.3.

Get some sleep, I will figure this out.


help me help you
rob
« Last Edit: May 27, 2009, 03:46:23 am by jamesdean »
Logged
PLease post your Pfsense Version and Snort Version when asking questions. Thank you.

Offline simonchs

  • Newbie
  • *
  • Posts: 18
  • Karma: +0/-0
    • View Profile
Re: snort problem
« Reply #59 on: May 27, 2009, 03:46:14 am »
i'm running pfsense version 1.2.2

thanks James
Logged
Pages: 1 2 3 [4] 5 6 7   Go Up
« previous next »