Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 23 replies
  • Subscribers 2 subscribers
  • Views 25539 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

[INFO-115] Snort restart today

thomas_brewster
Anyone else noticing multiple units getting snort restarts today (2014-11-17).
We've had three different UTMs report multiple snort restarts this morning.

[INFO-115] Snort not running - restarted
Snort not running - restarted

Also noticing some new IPS hits on one of these units;
(smtp) Attempted response buffer overflow: ???? chars

Regards,
Thomas


This thread was automatically locked due to age.
Parents Reply Children
  • 0 in reply to mdallagi
    Hi,

    just tried it with Pattern Version: 70549 on 9.300-5. It still does not work (for us). [:(]
    But iam also in contact with Sophos about that issue right now. I'll report back.
  • 0 in reply to guawhitehawk
    Per this morning 11/21/2014 the IPS was still causing significant slowdowns. I just got word from some other support people that the root of the problem seems to be another set of bad (corrupt) definitions pushed down to snort.  

    There is an expected update to fix this to be "released any time now".  And I gather this affected not just Sophos UTMs, but for other products using snort as well. (Fortinet was mentioned)