Problems with Snort 2.9.11.0 - Snort is terminating unexpectedly

[Anna <Anna () sonru com>]

Hello,

I have another problem now. I upgraded the 2.9.9.0 to 2.9.11 and the problem with snort using too much memory went 
away. It got replaced with Snort working for  few hours and terminating while the top is showing that snort is still 
running.

Snort was upgraded and started on 13th of Oct at 9:31 am

Oct 13 09:31:46 DEV_SERVER systemd: Started Snort NIDS Daemon.
Oct 13 09:31:46 DEV_SERVER systemd: Starting Snort NIDS Daemon...
Oct 13 09:31:56 DEV_SERVER kernel: device eth0 entered promiscuous mode

then on 14th of Oct at 3:21am it stopped and tried to restart (probably hanged that is why OS is still showing snort as 
running)

Oct 14 03:21:01 DEV_SERVER systemd: Stopping SYSV: snort is a lightweight network intrusion detection tool that 
currently detects more than 1100 host and network vulnerabilities, portscans, backdoors, and more....
Oct 14 03:21:02 DEV_SERVER snort: *** Caught Term-Signal
Oct 14 03:21:02 DEV_SERVER kernel: device eth0 left promiscuous mode
Oct 14 03:21:03 DEV_SERVER snortd: Stopping snort: [  OK  ]
Oct 14 03:21:03 DEV_SERVER systemd: Starting SYSV: snort is a lightweight network intrusion detection tool that 
currently detects more than 1100 host and network vulnerabilities, portscans, backdoors, and more....
Oct 14 03:21:03 DEV_SERVER snort[12509]: Running in IDS mode
Oct 14 03:21:03 DEV_SERVER snort[12509]:
Oct 14 03:21:03 DEV_SERVER snort[12509]:        --== Initializing Snort ==--
Oct 14 03:21:03 DEV_SERVER snort[12509]: Initializing Output Plugins!
Oct 14 03:21:03 DEV_SERVER snort[12509]: Initializing Preprocessors!
Oct 14 03:21:03 DEV_SERVER snort[12509]: Initializing Plug-ins!
Oct 14 03:21:03 DEV_SERVER snort[12509]: Parsing Rules file "/etc/snort/snort.conf"
Oct 14 03:21:03 DEV_SERVER snort[12509]: PortVar 'HTTP_PORTS' defined :
Oct 14 03:21:03 DEV_SERVER snort[12509]: [ 80:81 443 8000 8008 8080:8081 8085 8088 ]
Oct 14 03:21:03 DEV_SERVER snort[12509]:
Oct 14 03:21:03 DEV_SERVER snort[12509]: PortVar 'SHELLCODE_PORTS' defined :
Oct 14 03:21:03 DEV_SERVER snort[12509]: [ 0:79 81:65535 ]
Oct 14 03:21:03 DEV_SERVER snort[12509]:
Oct 14 03:21:03 DEV_SERVER snort[12509]: PortVar 'ORACLE_PORTS' defined :
Oct 14 03:21:03 DEV_SERVER snort[12509]: [ 1024:65535 ]
Oct 14 03:21:03 DEV_SERVER snort[12509]:
Oct 14 03:21:03 DEV_SERVER snort[12509]: PortVar 'SSH_PORTS' defined :
Oct 14 03:21:03 DEV_SERVER snort[12509]: [ 22 ]
Oct 14 03:21:03 DEV_SERVER snort[12509]:
Oct 14 03:21:03 DEV_SERVER snort[12509]: PortVar 'FTP_PORTS' defined :
Oct 14 03:21:03 DEV_SERVER snort[12509]: [ 21 2100 3535 ]
Oct 14 03:21:03 DEV_SERVER snort[12509]:
Oct 14 03:21:03 DEV_SERVER snort[12509]: PortVar 'SIP_PORTS' defined :
Oct 14 03:21:03 DEV_SERVER snort[12509]: [ 5060:5061 5600 ]
Oct 14 03:21:03 DEV_SERVER snort[12509]:
Oct 14 03:21:03 DEV_SERVER snort[12509]: PortVar 'FILE_DATA_PORTS' defined :
Oct 14 03:21:03 DEV_SERVER snort[12509]: [ 80:81 110 143 443 8000 8008 8080:8081 8085 8088 ] 


This is happening to all servers I upgraded so this is not isolated incident. 


How to put the snort activity logs in debug and redirect them from messages (not the u2 logs that are going to 
barnyard)? Also when the Snort is about the terminate those logs are created snort.log.1507951274 (there is not -l flag 
in the start command or any other output files in snort.conf) they contain the detected traffic logs 
^@^D<8a>Óï^@PKr^W? ô<82>\<80>^X^O¦^MÉ^@^@^A^A^H
^Y)×<9e><94>Íg­HEAD http://52.125.242.20:80/PMA/ HTTP/1.1^M
Connection: Keep-Alive^M
Keep-Alive: 300^M
User-Agent: Mozilla/5.0 Jorgee^M
Host: 52.125.242.20^M

Alerts log is updated with the alerts from Snort that should go to barnyard2/Snorby

10/17-11:12:09.240501  [**] [120:3:1] (http_inspect) NO CONTENT-LENGTH OR TRANSFER-ENCODING IN HTTP RESPONSE [**] 
[Classification: Unknown Traffic] [Priority: 3] {TCP} 10.0.4.224:80 -> 10.0.4.138:46108

But Snort is not running according to systemd since Oct 14 03:21:02 DEV_SERVER snort[32171]: *** Caught Term-Signal

When I try to start snort with systemd without killing the one that is “running” according to OS, they are two 
processes running then.

Anybody can shed any light in what is going on with my upgraded Snort?

Thank you

Anna

_______________________________________________
Snort-users mailing list
Snort-users () lists snort org
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!