Snort always crashes

hello, installed openwrt 23.05.2 and installed the snort package. it always crashes, by using that debug commands there are no errors... pls help

homenet.lua:

-- setup HOME_NET below with your IP range/ranges to protect
HOME_NET = [[ 192.168.0.0/24 192.168.3.0/24 192.168.4.0/24 ]]
EXTERNAL_NET = "!$HOME_NET"

local.lua:

-- use ths file to customize any functions defined in /etc/snort/snort.lua

-- switch tap to inline in ips and uncomment the below to run snort in inline mode
snort = {}
snort["-Q"] = true

ips = {
  --mode = tap,
  mode = inline,
  variables = default_variables,
  action_override = reject,
  -- uncomment and change the below to reflect rules or symlinks to rules on your filesystem
  -- include = RULE_PATH .. '/snort.rules',
  include = RULE_PATH .. '/snort3-community-rules/snort3-community.rules'
}

daq = {
  module_dirs = {
    '/usr/lib/daq',
  },
  modules = {
    {
      name = 'afpacket',
      mode = 'inline',
    }
  }
}

alert_syslog = {
  level = 'info',
}

-- To log to a file, uncomment the below and manually create the dir defined in output.logdir
output.logdir = '/var/log/snort'
alert_fast = {
  file = true,
  packet = false,
}

normalizer = {
  tcp = {
    ips = true,
  }
}

file_policy = {
  enable_type = true,
  enable_signature = true,
  rules = {
    use = {
      verdict = 'log', enable_file_type = true, enable_file_signature = true
    }
  }
}

-- To use openappid with snort, install the openappid package and uncomment the below
--appid = {
--    app_detector_dir = '/usr/lib/openappid',
--    log_stats = true,
--    app_stats_period = 60,
--}

I have tried:
snort -c /etc/snort/snort.lua --tweaks local -T -Q
and
snort -c /etc/snort/snort.lua --daq-dir /usr/lib/daq -T -Q

no errors, but when I start the service it still says running but it doesn't block anything and with htop I can see it crashes, also logread -e snort tells me so
Thx!

update: I found now the error, there has been no 'snort' directory in /var/log and that's why it crashed...

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.