[8.910][BUG] Snort not running - restarted

Hi,

after the upgrade to 8.910 I get the following notification mail after a reboot of UTM:

Snort not running - restarted
--
System Uptime      : 0 days 0 hours 2 minutes
System Load        : 0.87
System Version     : Sophos UTM 8.910

Please refer to the manual for detailed instructions.

Franc.

0 snowcrash_01 over 13 years ago

Hi,
I also got this message - it looks if the selfmon check is faster than the IPS can start ;o)
But it's now running for 2 hours without problems.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 cziel over 13 years ago in reply to snowcrash_01

Hi,

anything new to report? Any limitations/restrictions in usability/viability? Maybe something related in the logs?

Thanks,
Cristof
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 67ef1d over 13 years ago

Hi,

after the upgrade to 8.910 I get the following notification mail after a reboot of UTM:

Snort not running - restarted

Thanks for reporting.

Could you please check if your ips.log contains the line
FATAL ERROR: SetupDNP3

(try "grep FATAL /var/log/ips.log" on command line)

if yes, then this should be resolved in the next version
(problem is that snort chokes on "reload" commands and is then restarted
by selfmon).
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 FrancWest over 13 years ago in reply to 67ef1d

Hi,

indeed, the log contains the following after a reboot:

FATAL ERROR: SetupDNP3(): The Stream preprocessor must be enabled.

IPS is functioning normally though.

Franc.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 Astaro Beta Bot over 13 years ago

Thanks for reporting. We are now tracking this as Mantis ID #19199
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 Astaro Beta Bot over 13 years ago

The Mantis ID #19199 is now fixed. We are planning to release a fix for this issue in Version 8.302.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 BrucekConvergent over 13 years ago in reply to Astaro Beta Bot

Quoted from Beta Bot:

"The Mantis ID #19199 is now fixed. We are planning to release a fix for this issue in Version 8.302. "

8.302? Or do you mean 8.920, etc.?

CTO, Convergent Information Security Solutions, LLC

https://www.convergesecurity.com

Advice given as posted on this forum does not construe a support relationship or other relationship with Convergent Information Security Solutions, LLC or its subsidiaries. Use the advice given at your own risk.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 kbr over 13 years ago

Hi Bruce,

I reused the Mantis ID #19199 for this issue, because the problem that Franc reported is a bug that also exists in 8.301 and will be fixed in 8.302, which will probably be released in the next few weeks. All the fixes that go into 8.302 are (or will be) also in the upcoming V9 beta releases.

The reason why we reuse such Mantis IDs is, that we try to keep the number of duplicate IDs low.

Cheers,
Kai
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 BrucekConvergent over 13 years ago in reply to kbr

No worries Kai -- I guess that fix will be rolled into 8.920 or later. -- realize that us "civilians" don't have access to Mantis, so I wasn't sure. Makes sense!

CTO, Convergent Information Security Solutions, LLC

https://www.convergesecurity.com

Advice given as posted on this forum does not construe a support relationship or other relationship with Convergent Information Security Solutions, LLC or its subsidiaries. Use the advice given at your own risk.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 kbr over 13 years ago in reply to BrucekConvergent

Hi Bruce,

... realize that us "civilians" don't have access to Mantis ...

that's why i took the time and tried to explain what's going on behind the scenes... ;-)

Cheers,
Kai
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel

[8.910][BUG] Snort not running - restarted

Submitted a Tech Support Case lately from the Support Portal?