Monitoring Snort IDS with Vigilmon

Snort is the most widely deployed open-source intrusion detection and prevention system (IDS/IPS) — it performs real-time packet analysis, protocol decoding, and content matching against a library of rules to detect and block network attacks. When Snort stops running, your network loses its most critical layer of threat visibility. Vigilmon keeps watch on Snort's process health, rule update pipeline, and web UI availability so you're alerted the moment your detection capability goes dark.

What You'll Set Up

• TCP port check for Snort in inline/IPS mode
• HTTP monitor for the Snort web console (Snorby or Barnyard2 web UI)
• Heartbeat monitor for PulledPork/Oinkmaster rule update cron jobs
• SSL certificate alerts for the Barnyard web interface

Prerequisites

• Snort 2.x or 3.x installed and running
• PulledPork or Oinkmaster configured for rule updates
• Optional: Snorby or Barnyard2 web UI deployed
• A free Vigilmon account

Step 1: Monitor Snort Process Availability via TCP

When Snort runs in inline (IPS) mode, it binds to a management port or DAQ interface. A TCP check against the host confirms the process is alive and accepting connections. If you've configured a management socket or use snort --enable-inline-test, check the relevant port:

1. Log in to vigilmon.online and click Add Monitor.
2. Set Type to TCP Port.
3. Enter your Snort host IP and the management port (e.g. 8080 for a REST management API if using Snort 3 with --control-socket).
4. Set Check interval to 2 minutes.
5. Click Save.

If Snort has no exposed TCP port (passive IDS mode with no management interface), use a heartbeat-based systemd check instead — see Step 3.

Step 2: Monitor the Snort Web Console

If you use Snorby (the Ruby on Rails Snort web UI) or a Barnyard2 web output, monitor the web interface directly:

1. Add Monitor → HTTP / HTTPS.
2. URL: http://YOUR_SNORBY_HOST:3000 (or https:// if TLS-terminated).
3. Set Check interval to 2 minutes.
4. Set Expected HTTP status to 200.
5. Under Advanced, set Expected body contains to a string unique to the Snorby dashboard (e.g. Snorby or Events).
6. Click Save.

A 200 response with the expected body confirms Snorby's Rails process is running and the database connection is healthy. A 503 or redirect to an error page indicates a crashed Rails worker or failed DB connection.

For PulledPork's own status page (if configured), add a second HTTP monitor pointing at that URL with the appropriate keyword check.

Step 3: Heartbeat Monitor for PulledPork Rule Updates

Snort's detection quality depends on current rules. PulledPork (or Oinkmaster) downloads updated rule sets from Talos on a schedule — if those cron jobs fail silently, Snort keeps running but with stale signatures. A heartbeat monitor catches this gap.

Create a wrapper script for your rule update cron:

# /usr/local/bin/pulledpork-heartbeat.sh
#!/bin/bash
set -euo pipefail

# Run PulledPork and send heartbeat only on success
/usr/local/bin/pulledpork.pl -c /etc/snort/pulledpork.conf -l && \
  /usr/bin/curl -fsS "https://vigilmon.online/api/heartbeat/YOUR_HEARTBEAT_ID" > /dev/null 2>&1

Update your crontab:

# /etc/cron.d/snort-rule-update
0 2 * * * root /usr/local/bin/pulledpork-heartbeat.sh >> /var/log/pulledpork.log 2>&1

In Vigilmon, set up the heartbeat:

1. Click Add Monitor → Heartbeat.
2. Name it Snort PulledPork rule update.
3. Set Expected interval to 24 hours.
4. Set Grace period to 2 hours.
5. Copy the heartbeat URL and paste it into the script above.
6. Click Save.

If PulledPork fails (network unreachable, Talos auth error, config issue), the heartbeat is never sent and Vigilmon alerts you — giving you time to investigate before signatures go stale.

Step 4: Monitor Snort Process via Systemd Heartbeat

For passive IDS deployments without a TCP management port, use a systemd-based heartbeat:

# /etc/cron.d/snort-heartbeat
* * * * * root /usr/bin/systemctl is-active --quiet snort && \
  /usr/bin/curl -fsS "https://vigilmon.online/api/heartbeat/YOUR_SNORT_DAEMON_HEARTBEAT_ID" > /dev/null 2>&1

In Vigilmon:

1. Add Monitor → Heartbeat.
2. Name it Snort daemon heartbeat.
3. Set Expected interval to 2 minutes.
4. Set Grace period to 3 minutes.
5. Paste the heartbeat URL into the cron command.
6. Click Save.

This catches a crashed Snort process regardless of mode — the cron fires every minute, and if Snort is down the heartbeat is withheld, triggering an alert after the grace period.

Step 5: SSL Certificate Alerts for Barnyard/Snorby Web UI

If your Snort web console (Snorby or Barnyard2 output web UI) is served over HTTPS, monitor the certificate:

1. Open the HTTP/HTTPS monitor for your web console (created in Step 2).
2. Enable Monitor SSL certificate in the SSL section.
3. Set Alert when certificate expires in less than 14 days.
4. Click Save.

An expired certificate on the Snorby UI means security analysts lose access to the event dashboard — at the worst possible time, when they need to investigate an active incident. The 14-day window gives you time to renew before access is blocked.

Summary

| Monitor | Target | What It Catches | |---|---|---| | TCP port | Snort management port | Process crash in IPS mode | | Web console HTTP | Snorby/Barnyard2 UI | Rails crash, DB failure | | PulledPork heartbeat | cron rule update | Stale Snort signatures | | Daemon heartbeat | cron + systemctl | Passive IDS process crash | | SSL certificate | Snorby/web UI | Certificate expiry |

Snort's intrusion detection is only as good as its uptime and rule currency. A crashed daemon leaves your network blind to active attacks; stale rules mean new threat signatures go undetected. Vigilmon's combination of process checks and heartbeat monitors ensures both the detection engine and its rule pipeline stay healthy.