Thread Info
  • State Not Answered
  • Replies 8 replies
  • Subscribers 6 subscribers
  • Views 3364 views
  • Users 0 members are here
Options
Suggested

IPS Service DEAD

Jason Vorbeck

Following the upgrade from SFOS 17.5.8 MR-8 to SFOS 18.0.0 EAP1 the IPS Service would not start. 

I've got quite a large IPS.log captured but the juiciest bit seems to be... (below). Anyone experienced this? I rolled back to 17.5 for now.

 

[Oct 19 11:01:31 :42586]:nse_sal_init:Exit --> DAQ_ERROR
[Oct 19 11:01:31 :42586]:ssl_daq_initialize:Failed to initialize NSE Software abstraction layer
double free or corruption (!prev)
Get signal 6
backtrace() returned 18 addresses
/bin/snort() [0x439a7a]
/lib/x86_64-linux-gnu/libpthread.so.0(+0x11850) [0x7f02c58a1850]
/lib/x86_64-linux-gnu/libc.so.6(gsignal+0xca) [0x7f02c481c5da]
/lib/x86_64-linux-gnu/libc.so.6(abort+0x141) [0x7f02c481d6a1]
/lib/x86_64-linux-gnu/libc.so.6(+0x746ff) [0x7f02c485c6ff]
/lib/x86_64-linux-gnu/libc.so.6(+0x7a96a) [0x7f02c486296a]
/lib/x86_64-linux-gnu/libc.so.6(+0x7c3dc) [0x7f02c48643dc]
/lib/libnse_sal.so(destroy_mempool+0x12) [0x7f02bc138a12]
/lib/libnse_sal.so(nse_sal_shutdown+0x3f) [0x7f02bc1363ef]
/lib/daq/sophos/daq_ssl.so(+0x5bbd) [0x7f020e545bbd]
/lib/daq/sophos/daq_ssl.so(+0xa126) [0x7f020e54a126]
/lib/daq/daq_multi.so(InitDAQ+0x20a) [0x7f024fc9ae3a]
/lib/daq/daq_multi.so(LoadandInitDAQs+0x689) [0x7f024fc9bd99]
/lib/daq/daq_multi.so(+0xee2f) [0x7f024fc9ee2f]
/bin/snort() [0x450e7c]
/bin/snort() [0x4393a7]
/lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xe7) [0x7f02c4809aa7]
/bin/snort() [0x40e2aa]
------------------NONONONONONO

Parents
  • 0

    Hi,

    did you try each of these and if so what result did you see?

    1/. Restart the XG or power off completely then start?

    2/. try starting the IPS from the GUI?

    Ian

    XG115W - v20.0.2 MR-2 - Home

    XG on VM 8 - v21 GA

    If a post solves your question please use the 'Verify Answer' button.

  • 0 in reply to rfcat_vk

    Hey Ian, yes I shut the VM down and restarted it twice without any change in the behavior. When I clicked the start button on the service in the GUI the services page eventually gives me the yellow banner about it taking a long time. After some long time the service status reads "DEAD". I setup the logging and clicked the start service button again to start producing the logging output. There is a lot more to the logs than what I put here. I opened a case but they closed it and told me they wouldn't help me with v18 so I just rolled it back. If you want the whole log outputi have it.

Reply
  • 0 in reply to rfcat_vk

    Hey Ian, yes I shut the VM down and restarted it twice without any change in the behavior. When I clicked the start button on the service in the GUI the services page eventually gives me the yellow banner about it taking a long time. After some long time the service status reads "DEAD". I setup the logging and clicked the start service button again to start producing the logging output. There is a lot more to the logs than what I put here. I opened a case but they closed it and told me they wouldn't help me with v18 so I just rolled it back. If you want the whole log outputi have it.

Children
Unfiltered HTML