Re: Snort 3.1.18.0 on Ubuntu 18 & 20

Hi,
regarding the configuration issue, you cannot enable tcmalloc and jemalloc at the same time, you need to select one of them. You can base your choice on, for example, this answer: https://stackoverflow.com/a/60499882 . Also, you can't "compensate for the error" by calling configure_cmake.sh twice in a row, because the second run will overwrite the results of the first one.

Regarding what you got in the logs, this seems like a some kind of snort3 crash. Looks like a bug, we can fix it, but we need some help from you, namely:
1) add the --enable-debug flag to your configure_cmake.sh run command;
2) rebuild snort3;
3) enable saving cordumps on your system: ulimit -S -c unlimited
4) start your snort3 service and wait for it to crash
5) upload to your snort3 binary and the generated coredump (you can find out its approximate location using cat /proc/sys/kernel/core_pattern). They will weigh a lot, so it's better to upload them to some kind of file sharing service.

Thank you in advance!

From: Michael Steele <[email protected]>
Date: Tuesday, 21 March 2023, 17:28
To: Vitalii Serhiiovych Horbatov -X (vhorbato - SOFTSERVE INC at Cisco) <[email protected]>
Cc: [email protected] <[email protected]>
Subject: RE: [Snort-users] Snort 3.1.18.0 on Ubuntu 18 & 20
There is an issue with the line below:

./configure_cmake.sh --prefix=/usr/local --enable-tcmalloc --enable-jemalloc

It refuses to install with the above line and the output is below:

morpheus@Morpheus:~/snort_src/snort3-3.1.57.0$<mailto:morpheus@Morpheus:~/snort_src/snort3-3.1.57.0$> ./configure_cmake.sh --prefix=/usr/local --enable-tcmalloc --enable-jemalloc
--enable-jemalloc and --enable-tcmalloc are mutually exclusive; enable at most one
morpheus@Morpheus:

I revised the line to the below and it completed but I’m unsure of the ramifications by omitting the --enable-jemalloc

./configure_cmake.sh --prefix=/usr/local --enable-tcmalloc

Not sure if I should run the two lines below to compensate for the error:

./configure_cmake.sh --prefix=/usr/local --enable-tcmalloc
./configure_cmake.sh --prefix=/usr/local --enable- jemalloc

Thanks…

From: Vitalii Serhiiovych Horbatov -X (vhorbato - SOFTSERVE INC at Cisco) <[email protected]>
Sent: Tuesday, March 21, 2023 6:19 AM
To: Michael Steele <[email protected]>
Cc: [email protected]
Subject: Re: [Snort-users] Snort 3.1.18.0 on Ubuntu 18 & 20


Hi Michael, could you please attach your config and full log message(using systemctl -l status snort3 for example)?

Thanks,
Vitalii!

From: Snort-users <[email protected]<mailto:[email protected]>> on behalf of Michael Steele <[email protected]<mailto:[email protected]>>
Date: Monday, 20 March 2023, 15:15
To: [email protected]<mailto:[email protected]> <[email protected]<mailto:[email protected]>>
Subject: [Snort-users] Snort 3.1.18.0 on Ubuntu 18 & 20


I’m getting to the section “Enable the Snort systemD service and start it:” in the guide and the error below happens. Not sure what I did wrong but the install has been good up to this poing.

morpheus@Morpheus:~/snort_src/pulledpork3$ sudo systemctl enable snort3
morpheus@Morpheus:~/snort_src/pulledpork3$ sudo service snort3 start
morpheus@Morpheus:~/snort_src/pulledpork3$ service snort3 status
● snort3.service - Snort3 NIDS Daemon
     Loaded: loaded (/lib/systemd/system/snort3.service; enabled; vendor preset: enabled)
     Active: failed (Result: signal) since Sun 2023-03-19 18:53:56 EDT; 5s ago
    Process: 1666 ExecStart=/usr/local/bin/snort -c /usr/local/etc/snort/snort.lua -s 65535 -k none -l /var/log/snort ->
   Main PID: 1666 (code=killed, signal=ABRT)
        CPU: 8.642s

Mar 19 18:53:56 Morpheus snort[1666]:   #9 0x564aec1a5844 in _ZN5ACRun7executeER8AnalyzerPPv+0x14 (/usr/local/bin/snort>
Mar 19 18:53:56 Morpheus snort[1666]:   #10 0x564aec1a4a25 in _ZN8Analyzer14handle_commandEv+0xa5 (/usr/local/bin/snort>
Mar 19 18:53:56 Morpheus snort[1666]:   #11 0x564aec1a504d in _ZN8Analyzer7analyzeEv+0x3d (/usr/local/bin/snort @0x564a>
Mar 19 18:53:56 Morpheus snort[1666]:   #12 0x564aec1a5215 in _ZN8AnalyzerclEP7Swappert+0xb5 (/usr/local/bin/snort @0x5>
Mar 19 18:53:56 Morpheus snort[1666]:   #13 0x7f5ae8d76de4 in _ZNKSt10error_code23default_error_conditionEv+0x34 (/lib/>
Mar 19 18:53:56 Morpheus snort[1666]:   #14 0x7f5ae9a3a609 in start_thread+0xd9 (/lib/x86_64-linux-gnu/libpthread.so.0 >
Mar 19 18:53:56 Morpheus snort[1666]:   #15 0x7f5ae8a61133 in clone+0x43 (/lib/x86_64-linux-gnu/libc.so.6 @0x7f5ae89420>
Mar 19 18:53:56 Morpheus systemd[1]: snort3.service: Main process exited, code=killed, status=6/ABRT
Mar 19 18:53:56 Morpheus systemd[1]: snort3.service: Failed with result 'signal'.
Mar 19 18:53:56 Morpheus systemd[1]: snort3.service: Consumed 8.642s CPU time.

morpheus@Morpheus:

Thanks…

_______________________________________________
Snort-users mailing list
[email protected]
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

	To unsubscribe, send an email to:
	[email protected]

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette