Bug Tracking System

View Issue Details Jump to Notes ] Issue History ] Print ]
IDProjectCategoryView StatusDate SubmittedLast Update
0001651PacketFencecorepublic2013-06-12 15:082013-07-12 16:23
Assigned Todwuelfrath 
PlatformAllOSAllOS VersionAll
Product Version4.0.1 
Target VersionFixed in Version 
Summary0001651: Snort cannot start if pfdetect is not started
DescriptionWhen we start PacketFence, we create a FIFO (/usr/local/pf/var/alert) in which Snort is writing detected alerts.

Snort is trying to open that FIFO in WRITE mode but a FIFO can only be opened in WRITE if a process already opened that FIFO in READ.

Currently, PacketFence starts Snort before pfdetect (starting sequence) which cause Snort to hung since the FIFO cannot be opened in WRITE due to the lack of a process opening that FIFO in READ (pfdetect).

Startup sequence need to be adapted so that pfdetect is started before Snort.
TagsNo tags attached.
fixed in git revision
fixed in mtn revision
Attached Files

- Relationships

-  Notes
dwuelfrath (administrator)
2013-06-14 14:09

Mitigate in c2d817f0ecb53fb7a95a97fcd798ae1140b07f33
lpelet (reporter)
2013-07-12 16:23

Same error when Suricata try to log into the fifo alert.
Patch suricata.yaml in section where the alert file is declared to specify filetype = regular

view [^]

- Issue History
Date Modified Username Field Change
2013-06-12 15:08 dwuelfrath New Issue
2013-06-12 15:09 dwuelfrath Assigned To => dwuelfrath
2013-06-12 15:09 dwuelfrath Status new => confirmed
2013-06-14 14:09 dwuelfrath Note Added: 0003325
2013-06-14 14:09 dwuelfrath Status confirmed => assigned
2013-06-14 14:09 dwuelfrath Resolution open => suspended
2013-07-12 16:23 lpelet Note Added: 0003341

Copyright © 2000 - 2012 MantisBT Group
Powered by Mantis Bugtracker