pfSense » pfSense Packages

Upgrading from 2.3.3 to 2.4 removes Snort from the drop-down.

During the upgrade process I see this:

The following 4 package(s) will be affected (of 0 checked):

Installed packages to be REINSTALLED:
        pfSense-pkg-snort-3.2.9.2_16 [pfSense] (ABI changed: 'freebsd:10:x86:64' -> 'freebsd:11:x86:64')
        pfSense-pkg-ipsec-profile-wizard-0.9_4 [pfSense] (ABI changed: 'freebsd:10:x86:64' -> 'freebsd:11:x86:64')
        pfSense-pkg-aws-wizard-0.5_1 [pfSense] (ABI changed: 'freebsd:10:x86:64' -> 'freebsd:11:x86:64')
        pfSense-pkg-AutoConfigBackup-1.47 [pfSense] (ABI changed: 'freebsd:10:x86:64' -> 'freebsd:11:x86:64')

Number of packages to be reinstalled: 4
[1/4] Reinstalling pfSense-pkg-snort-3.2.9.2_16...
[1/4] Extracting pfSense-pkg-snort-3.2.9.2_16: .......... done
Removing snort components...
Menu items... done.
Services... done.
Loading package instructions...
pkg: Fail to rename /var/db/snort/sidmods/.disablesid-sample.conf.0NuTs0hpJjDf -> /var/db/snort/sidmods/disablesid-sample.conf: No such file or directory

Once the upgrade completes I can see the Snort package under Installed Packages and noticed this at the bottom of the Installed Packages page:

Newer version available

Package is configured but not (fully) installed

The Snort dashboard still shows but the service is missing from the Services drop-down. Here is the system log pertaining to Snort:

[2.4.0-BETA][root@pfSense.localdomain]/root: clog /var/log/system.log | grep -i snort
Feb 23 17:37:12 pfSense pkg: snort-2.9.8.3 installed
Feb 23 17:37:12 pfSense php: /etc/rc.packages: Beginning package installation for snort .
Feb 23 17:37:12 pfSense php: /etc/rc.packages: [Snort] Package post-installation tasks completed...
Feb 23 17:37:13 pfSense php: /etc/rc.packages: Successfully installed package: snort.
Feb 23 17:37:13 pfSense pkg: pfSense-pkg-snort-3.2.9.2_16 installed
Feb 23 17:37:37 pfSense php-fpm[91937]: /snort/snort_interfaces.php: [Snort] Updating rules configuration for: LAN ...
Feb 23 17:37:37 pfSense php-fpm[91937]: /snort/snort_interfaces.php: [Snort] Warning - no text rules or IPS-Policy selected for: LAN ...
Feb 23 17:37:37 pfSense php-fpm[91937]: /snort/snort_interfaces.php: [Snort] Building new sid-msg.map file for LAN...
Feb 23 17:37:37 pfSense php-fpm[91937]: /snort/snort_interfaces.php: Starting Snort on LAN(igb1) per user request...
Feb 23 17:37:37 pfSense php-fpm[91937]: /snort/snort_interfaces.php: [Snort] Snort START for LAN(igb1)...
Feb 23 17:42:06 pfSense SnortStartup[56768]: Snort START for LAn(18926_igb1)...
Feb 23 17:53:57 pfSense SnortStartup[66634]: Snort START for LAn(18926_igb1)...
Feb 23 17:54:00 pfSense SnortStartup[81505]: Snort STOP for LAn(18926_igb1)...
Feb 23 17:54:01 pfSense snort[78533]: *** Caught Term-Signal
Feb 23 17:54:03 pfSense php: /etc/rc.packages: [Snort] Snort package uninstall in progress...
Feb 23 17:54:14 pfSense php: /etc/rc.packages: [Snort] Removing package files...
Feb 23 17:54:14 pfSense php: /etc/rc.packages: [Snort] Not saving settings... all Snort configuration info and logs will be deleted...
Feb 23 17:54:14 pfSense php: /etc/rc.packages: [Snort] Flushing <snort2c> firewall table to remove addresses blocked by Snort...
Feb 23 17:54:14 pfSense php: /etc/rc.packages: [Snort] The package has been completely removed from this system.

Re-installing the Snort package corrects this issue and retains the user's configuration.

I've tested this on a SG-2220 and C2758.