pfSense » pfSense Packages

This is not a bug. This is due to having incorrect user-supplied text rules for the current version of the OpenAppID detector stubs package. You are using an old and out-of-date user text rules package with OpenAppID. It is up to the OpenAppID function user to craft and configure the necessary text rules to work with the current OpenAppID rules stubs package from the Snort Vulnerability Research Team.

OpenAppID is NOT like the other rules at all. You can't simply enable it and have it work. User intervention is mandatory to craft and configure suitable text rules to stay in step with the rules stubs provided from Snort VRT. Those stubs frequently get updated by upstream.

As with everything the Snort binary does not like during startup, it will perform a FATAL ERROR exit and not continue startup. This behavior is by design in the Snort binary and cannot be changed short of rewriting the Snort binary. The "fail open" is how it is designed, unfortunately.