yesterday (sunday) at 3 am SNORT stopped to work with the result that internal nets couldn't reach Internet anymore. In the logs I found
FATAL ERROR: Failed to load /usr/lib/snort/so_rules//file-java.so: /usr/lib/snort/so_rules//file-java.so: file too short
Disabling IPS gave Internet back to local nets. No need to say that nothing was done at UTM level since weeks.
If someone had an idea on why does this suddenly happened, what does it mean, and finally how to solve it.
I found a similar one solved 7 months ago: https://community.sophos.com/utm-firewall/f/general-discussion/131375/solved-ips-blocks-all-network-traffic/483112#483112
You probably need to delete /var/chroot-snort/usr/lib/snort/so_rules/file-java.so instead of the one mentioned in the post by emmosophos.
Cheers - Bob
I saw this thread and checked UTM files: the file-java.so doesn't exist, it was perhaps deleted when I swithed IPS off. I switch it on again and will see.