Bug #16779: PHP parse error on boot after upgrade to 26.03 with suricata - pfSense Packages - pfSense bugtracker

Actions

Copy link

Bug #16779

open

PHP parse error on boot after upgrade to 26.03 with suricata

Added by Alexander Lindqvist 2 months ago. Updated 23 days ago.

Status:

New

Priority:

High

Assignee:

Category:

Suricata

Target version:

Start date:

Due date:

% Done:

Estimated time:

Plus Target Version:

Affected Version:

Affected Plus Version:

26.03

Affected Architecture:

6100

Description

This is a HA pair with suricata installed. Below error is after boot on both firewalls.
PHP Parse error: syntax error, unexpected identifier "suricata", expecting ")" in /usr/local/www/xmlrpc.php(141) : eval()'d code on line 14
[03-Apr-2026 22:38:12 Europe/Stockholm] PHP Parse error: syntax error, unexpected identifier "suricata", expecting ")" in /usr/local/www/xmlrpc.php(141) : eval()'d code on line 14
[03-Apr-2026 22:38:13 Europe/Stockholm] PHP Parse error: syntax error, unexpected identifier "suricata", expecting ")" in /usr/local/www/xmlrpc.php(141) : eval()'d code on line 14
[03-Apr-2026 22:38:15 Europe/Stockholm] PHP Parse error: syntax error, unexpected identifier "suricata", expecting ")" in /usr/local/www/xmlrpc.php(141) : eval()'d code on line 14

We also get the below xmlrpc error when saving a suricata rule change on primary firewall.

XMLRPC Error

Exception calling XMLRPC method exec_php # Received non-200 HTTP Code: 500. Response body:&lt;!DOCTYPE html&gt;
    &lt;html lang="en"&gt;
    &lt;head&gt;
    &lt;meta name="viewport" content="width=device-width, initial-scale=1"&gt;
    &lt;link rel="apple-touch-icon-precomposed" href="/apple-touch/apple-touch-icon-iphone-60x60-precomposed.png"&gt;
    &lt;link rel="apple-touch-icon-precomposed" sizes="60x60" href="/apple-touch/apple-touch-icon-ipad-76x76-precomposed.png"&gt;
    &lt;link rel="apple-touch-icon-precomposed" sizes="114x114" href="/apple-touch/apple-touch-icon-iphone-retina-120x120-precomposed.png"&gt;
    &lt;link rel="apple-touch-icon-precomposed" sizes="144x144" href="/apple-touch/apple-touch-icon-ipad-retina-152x152-precomposed.png"&gt;
    &lt;link rel="icon" type="image/png" sizes="32x32" href="/favicon-32x32.png"&gt;
    &lt;link rel="icon" type="image/png" sizes="16x16" href="/favicon-16x16.png"&gt;
    &lt;link rel="manifest" href="/manifest.json"&gt;
    &lt;link rel="mask-icon" href="/safari-pinned-tab.svg" color="#5bbad5"&gt;
    &lt;link rel="stylesheet" href="/vendor/bootstrap/css/bootstrap.min.css" type="text/css"&gt;
    &lt;link rel="stylesheet" href="/css/login.css" type="text/css"&gt;
    &lt;title&gt;50x Error&lt;/title&gt;
    &lt;script type="text/javascript"&gt;
    //&lt;![CDATA{
    var events = events || [];
    //]]>
    &lt;/script&gt;
    &lt;script src="/vendor/jquery/jquery-3.7.1.min.js"&gt;&lt;/script&gt;
    &lt;script src="/vendor/bootstrap/js/bootstrap.min.js"&gt;&lt;/script&gt;
    &lt;script src="/vendor/bootstrap/js/bootstrap.min.js"&gt;&lt;/script&gt;
    &lt;script&gt;
    $(function(){
    $("#logodiv").load("logo.svg");
    });
    &lt;/script&gt;

&lt;/head&gt;

&lt;body id="login"&gt;
    &lt;div id="total"&gt;
    &lt;header&gt;
    &lt;div id="headerrow"&gt;
    &lt;div class="row"&gt;
    &lt;div class="col-sm-4"&gt;
    &lt;div id="logodiv" style="text-align:center" class="nowarning"&gt;
    &lt;/div&gt;
    &lt;/div&gt;
    &lt;div class="col-sm-4 nowarning msgbox text-center text-danger"&gt;
    The web server encountered an error processing this request.&lt;br/&gt;
    &lt;br/&gt;
    Check the &lt;a href="/crash_reporter.php"&gt;Crash Reporter&lt;/a&gt; for details.
    &lt;/div&gt;
    &lt;div class="col-sm-4 nowarning msgbox text-center"&gt;
    &lt;h4&gt;50x Error&lt;/h4&gt;
    &lt;/div&gt;
    &lt;/div&gt;
    &lt;/div&gt;
    &lt;/header&gt;
    &lt;div style="background: #1e3f75;" class="pagebody"&gt;
    &lt;div class="col-sm-4"&gt;&lt;/div&gt;
    &lt;div class="col-sm-4 logoCol"&gt;
    &lt;div class="loginCont center-block text-center"&gt;
    &lt;strong&gt;&lt;a href="/"&gt;Return to Dashboard&lt;/a&gt;&lt;/strong&gt;
    &lt;/div&gt;
    &lt;/div&gt;
    &lt;div class="col-sm-4"&gt;&lt;/div&gt;
    &lt;/div&gt;
    &lt;footer id="3"&gt;
    &lt;div id="footertext"&gt;
    &lt;p class="text-muted"&gt;
    &lt;a target="_blank" href="https://pfsense.org"&gt;pfSense&lt;/a&gt;
    software is developed and maintained by
    &lt;a target="_blank" href="https://netgate.com"&gt;Netgate&lt;/a&gt;.
    &copy; ESF 2004 - 2026
    &lt;a target="_blank" href="https://pfsense.org/license"&gt;View license&lt;/a&gt;.
    &lt;/p&gt;
    &lt;/div&gt;
    &lt;/footer&gt;
    &lt;/div&gt;
    &lt;/body&gt;
    &lt;/html&gt;
    @ 2026-04-03 22:25:33

Actions

Copy link

Updated by Alexander Lindqvist 2 months ago

Rule changes syncs over to Secondary HA but it does not automatically reload the rules anymore.

Actions

Copy link

Updated by Bob Loi 26 days ago

Having the same issue here.
500 error with the option "Sync the configured system backup server" enabled.

With the option "Sync to defined hosts" i get the same bug:

PHP Errors:
[09-May-2026 23:52:35 Europe/Rome] PHP Parse error: syntax error, unexpected identifier "suricata", expecting ")" in /usr/local/www/xmlrpc.php(141) : eval()'d code on line 14
[09-May-2026 23:52:36 Europe/Rome] PHP Parse error: syntax error, unexpected identifier "suricata", expecting ")" in /usr/local/www/xmlrpc.php(141) : eval()'d code on line 14
[09-May-2026 23:52:37 Europe/Rome] PHP Parse error: syntax error, unexpected identifier "suricata", expecting ")" in /usr/local/www/xmlrpc.php(141) : eval()'d code on line 14
[09-May-2026 23:52:39 Europe/Rome] PHP Parse error: syntax error, unexpected identifier "suricata", expecting ")" in /usr/local/www/xmlrpc.php(141) : eval()'d code on line 14

Thanks

Actions

Copy link