Messages

Hi Franco,

thanks for the tipp, this fixed it :)

bye Josef

Hi,

I use graylog as syslog-target for opnsense. After the update to 23.7.4 there is no leading "hostname filterlog[PID]:" in the remote syslog messages.

bye Josef

I found the problem in my setup.
In the past 10 days there was a huge amount of new submissions to urlhaus, which results in a big increase of rules (from 30000 to 160000) :o https://urlhaus.abuse.ch/statistics/
My hardware (APU 2G RAM) was probably to poor in performance to load all rules in a reasonable time.

Hi all,

I just want to inform, in the actual (21.9.2020 15:00 CEST) abuse.ch/URLhaus rules is a bug wich prevents the IPS from starting  :o

[100151] <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "drop http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (510560)"; flow:established,from_client; content:"GET"; http_method; conte" from file /usr/local/etc/suricata/opnsense.rules/abuse.ch.urlhaus.rules at line 73508

OPNsense 20.7.2-amd64
FreeBSD 12.1-RELEASE-p8-HBSD
OpenSSL 1.1.1g 21 Apr 2020
CPU Type   AMD G-T40N Processor (2 cores)

I tried it with a WLE200NX but no luck. It seems that there is a driver missing.

Ist die Intrusion Detection aktiv? Wenn ja schalte sie mal aus.