Snort exits with a signal 11

[Paul Schmehl <pauls () utdallas edu>]

I'm trying to run snort on a dual processor AMD64 box running FreeBSD 6.2, and 
it starts and spawns a child, which runs for a short period of time (about five 
minutes?) and then exits with a signal 11.  I'm running snort with -vvvv to get 
extra reporting, but there's nada in /var/log/messages to help point to the 
cause.

So I started snort through ktrace with the following command:
ktrace /usr/local/bin/snort -u snort -g snort -Dq -vvvv -i bge0 -c 
/usr/local/etc/snort/snort.conf

Here's the /var/log/messages entry (hostname isn't the server's real name):
Dec 20 21:20:10 hostname snort[5902]: Daemon initialized, signaled parent pid: 
5901
Dec 20 21:20:10 hostname snort[5901]: Daemon parent exiting
Dec 20 21:20:10 hostname snort[5902]: Preprocessor/Decoder Rule Count: 0
Dec 20 21:20:10 hostname snort[5902]: Snort initialization completed 
successfully (pid=5902)
Dec 20 21:20:10 hostname snort[5902]: Not Using PCAP_FRAMES
Dec 20 21:20:11 hostname barnyard[52912]: Closing spool file 
'/var/log/snort/snort.log.1198164025'.  Read 0 records
Dec 20 21:20:11 hostname barnyard[52912]: Opened spool file 
'/var/log/snort/snort.log.1198185610'
Dec 20 21:20:11 hostname barnyard[52912]: Waiting for new data
Dec 20 21:38:11 hostname kernel: pid 5902 (snort), uid 1006: exited on signal 11
Dec 20 21:38:11 hostname kernel: bge0: promiscuous mode disabled

As you can see, there's nothing helpful in the log.

Here's the end of the ktrace:
     "<29>Dec 20 21:20:10 snort[5901]: Initializing daemon mode"
  5901 snort    RET   sendto 57/0x39
  5901 snort    CALL  getppid
  5901 snort    RET   getppid 51920/0xcad0
  5901 snort    CALL  sigaction(0x1d,0x7fffffffeaa0,0x7fffffffea80)
  5901 snort    RET   sigaction 0
  5901 snort    CALL  fork
  5901 snort    RET   fork 5902/0x170e
  5901 snort    CALL  wait4(0x170e,0x7fffffffeae4,0x1,0)
  5901 snort    RET   wait4 0
  5901 snort    CALL  nanosleep(0x7fffffffeac0,0x7fffffffeab0)
  5901 snort    RET   nanosleep -1 errno 4 Interrupted system call
  5901 snort    PSIG  SIG29 caught handler=0x4212c0 mask=0x0 code=0x0
  5901 snort    CALL  sigreturn(0x7fffffffe660)
  5901 snort    RET   sigreturn JUSTRETURN
  5901 snort    CALL  gettimeofday(0x7fffffffd7b0,0)
  5901 snort    RET   gettimeofday 0
  5901 snort    CALL  getpid
  5901 snort    RET   getpid 5901/0x170d
  5901 snort    CALL  sendto(0x3,0x7fffffffdcb0,0x36,0,0,0)
  5901 snort    GIO   fd 3 wrote 54 bytes
       "<29>Dec 20 21:20:10 snort[5901]: Daemon parent exiting"
  5901 snort    RET   sendto 54/0x36
  5901 snort    CALL  exit(0)

I compiled snort with --enable-64bit-gcc hoping that would make a difference, 
but it didn't.  (It *should* be able to run in 32 bit compatibility mode 
anyway.)

Does this trace point to anything useful?

-- 
Paul Schmehl (pauls () utdallas edu)
Senior Information Security Analyst
The University of Texas at Dallas
http://www.utdallas.edu/ir/security/


-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2005.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users