[Honeywall] Hflow: startup error

Dave dave at six66.clara.co.uk
Wed Oct 1 07:17:53 EDT 2008


Hi Rob,

I restarted hflow from the command line after reading Shawns reply, I
had been using Walleye and the Honeywall menu to restart hflow
previously, and it started first time. As a result hflow log did not
show any error.

Anyhow I attempted to restart hflow again from Walleye and the error
re-occurred. here is the content of hflow.log

start of snort_blockinit
snort_block:fifo exists attempting to delete
snort_block: successful deletion
snort_block: success creating pipe
snort_block: fork section done!
pcap out:initializing comm structs
pcap_out block: new thread 3075832720
open fifo done!-------------------
Snort block: failed to detect correct initialization of snort, aborting:
File exists


After recreating the error, hflow did restart from the command line
after several attempts.

Dave


Rob McMillen wrote:
> Anything reported in the log files located in /var/log/hflow?
>
> Rob
>
> On Tue, Sep 30, 2008 at 5:44 PM, Jefferson, Shawn
> <Shawn.Jefferson at bcferries.com> wrote:
>   
>> I have seen this error as well, although I've always been able to
>> restart hflow, at the command line with:
>>
>> service hflow restart
>>
>> I don't have a fix for you, but wanted to say that it's not a unique
>> problem you are experiencing!
>>
>> Shawn
>>
>>
>> -----Original Message-----
>> From: honeywall-bounces at public.honeynet.org
>> [mailto:honeywall-bounces at public.honeynet.org] On Behalf Of Dave
>> Sent: September 30, 2008 2:35 PM
>> To: Honeywall at public.honeynet.org
>> Subject: [Honeywall] Hflow: startup error
>>
>> Hi list,
>>
>> I am consistently getting the following Hflow start up error:
>>
>> Starting Hflow: premature failure. Initialization aborted? Parent
>> sighandler, something received. exiting!
>>
>>
>> Honeywall is on aVMware 1.6 server running on Ubuntu 8.04. eth0 is
>> bridged. eth1 host only. eth2 custom.
>> Yum updated to latest. Snort signatures have also been updated, other
>> than that there have been no changes to the Honeywall install.
>>
>> Honeywall has been working fine for a few weeks. This error has occurred
>> before, but after several attempts to restart the Honeywall processes
>> via the System Admin interface of Walleye I managed to get hflow
>> running. No such luck anymore after numerous reboots and attempts to
>> restart Honeywall from Walleye hflow consistently  fails to start.
>>
>> I have tried with and without the honeypot running and without any
>> physical network connections.
>>
>> Any suggestions as to how to resolve this without a rebuild?
>>
>> Cheers
>> Dave
>>
>>
>> _______________________________________________
>> Honeywall mailing list
>> Honeywall at public.honeynet.org
>> https://public.honeynet.org/mailman/listinfo/honeywall
>> _______________________________________________
>> Honeywall mailing list
>> Honeywall at public.honeynet.org
>> https://public.honeynet.org/mailman/listinfo/honeywall
>>
>>     
> _______________________________________________
> Honeywall mailing list
> Honeywall at public.honeynet.org
> https://public.honeynet.org/mailman/listinfo/honeywall
>
>
>
>   



More information about the Honeywall mailing list