iBDSghVQ

1Nov 29 12:06:28 	barnyard2 	64216 	WARNING: invalid Reference spec 'url,'. Ignored
2Nov 29 12:06:08 	php 		/usr/local/pkg/snort/snort_check_for_rule_updates.php: [Snort] Updating rules configuration for: WIFI ...
3Nov 29 12:06:08 	php 		/usr/local/pkg/snort/snort_check_for_rule_updates.php: [Snort] Building new sid-msg.map file for LAN...
4Nov 29 12:06:08 	php 		/usr/local/pkg/snort/snort_check_for_rule_updates.php: [Snort] Enabling any flowbit-required rules for: LAN...
5Nov 29 12:05:08 	php 		/usr/local/pkg/snort/snort_check_for_rule_updates.php: [Snort] There is a new set of Snort Subscriber rules posted. Downloading snortrules-snapshot-29120.tar.gz...
6Nov 29 09:51:18 	avahi-daemon 	81327 	Service "pfSense" (/usr/local/etc/avahi/services/sftp-ssh.service) successfully established.
7Nov 29 09:51:18 	avahi-daemon 	81327 	Service "pfSense" (/usr/local/etc/avahi/services/ssh.service) successfully established.
8Nov 29 09:51:08 	php-fpm 	339 	/rc.dyndns.update: phpDynDNS (): No change in my IP address and/or 25 days has not passed. Not updating dynamic DNS entry.
9Nov 29 09:50:18 	php-fpm 	87628 	/index.php: Successful login for user 'admin' from: 192.168.70.24 (Local Database)
10Nov 29 09:50:08 	barnyard2 	12669 	WARNING: Ignoring bad line in SID file: '/TALOS-2017-0350/ || url,www.talosintelligence.com/reports/TALOS-2017-0351/ || url,www.talosintelligence.com/reports/TALOS-2017-0380/'
11Nov 29 09:50:08 	barnyard2 	12669 	WARNING: Ignoring bad line in SID file: '/TALOS-2017-0350/ || url,www.talosintelligence.com/reports/TALOS-2017-0351/ || url,www.talosintelligence.com/reports/TALOS-2017-0380/'
12Nov 29 09:50:08 	barnyard2 	12669 	WARNING: Ignoring bad line in SID file: '/TALOS-2017-0350/ || url,www.talosintelligence.com/reports/TALOS-2017-0351/ || url,www.talosintelligence.com/reports/TALOS-2017-0380/'
13Nov 29 09:50:08 	php-fpm 	339 	/rc.start_packages: Beginning configuration backup to .https://acb.netgate.com/save
14Nov 29 09:50:08 	check_reload_status 		Syncing firewall
15Nov 29 09:49:38 	root 		/etc/rc.d/hostid: WARNING: hostid: unable to figure out a UUID from DMI data, generating a new one
16Nov 29 09:49:38 	kernel 		done.
17Nov 29 09:49:38 	php-cgi 		rc.bootup: Creating rrd update script
18Nov 29 09:49:28 	kernel 		route: writing to routing socket: Network is unreachable
19Nov 29 09:49:28 	php-cgi 		rc.bootup: Gateway, none 'available' for inet6, use the first one configured. ''
20Nov 29 09:49:28 	kernel 		.done.
21Nov 29 09:49:28 	php-cgi 		rc.bootup: Default gateway setting Interface WAN_DHCP Gateway as default.
22Nov 29 09:28:39 	kernel 		arp: 192.168.70.8 moved from 10:4f:a8:a6:cf:a5 to 40:49:0f:35:65:0d on igb2
23Nov 29 08:58:12 	kernel 		arp: 192.168.70.37 moved from 10:4f:a8:a6:cf:a5 to 40:49:0f:35:65:0d on igb2
24Nov 29 08:57:30 	php-fpm 		/index.php: Successful login for user 'admin' from: 192.168.90.3 (Local Database)
25Nov 29 08:56:21 	sshguard 	67801 	Attack from "192.168.90.3" on service 380 with danger 10.
26Nov 29 08:56:21 	php-fpm 		/index.php: webConfigurator authentication error for user 'admin' from: 192.168.90.3
27Nov 29 08:51:01 	php-fpm 		/index.php: Successful login for user 'admin' from: 192.168.70.24 (Local Database)
28Nov 29 08:50:47 	sshguard 	67801 	Attack from "192.168.70.24" on service 380 with danger 10.
29Nov 29 08:50:47 	php-fpm 		/index.php: webConfigurator authentication error for user 'yuriw' from: 192.168.70.24
30Nov 29 08:49:51 	php_pfb 		[pfBlockerNG] filterlog daemon started
31Nov 29 08:49:51 	php 		[pfBlockerNG] DNSBL parser daemon started
32Nov 29 08:49:51 	php_pfb 		[pfBlockerNG] filterlog daemon started
33Nov 29 08:49:51 	php-fpm 	339 	[pfBlockerNG] Restarting firewall filter daemon
34Nov 29 08:49:51 	check_reload_status 		Reloading filter
35Nov 29 08:49:51 	php-fpm 	339 	/rc.start_packages: End of configuration backup to https://acb.netgate.com/save (success).
36Nov 29 08:49:49 	php-fpm 	339 	/rc.start_packages: Beginning configuration backup to .https://acb.netgate.com/save
37Nov 29 08:49:49 	check_reload_status 		Syncing firewall
38Nov 29 08:49:48 	ntopng 		[HTTPserver.cpp:923] ERROR: Unable to start HTTP server (IPv4) on ports 3000
39Nov 29 08:49:48 	ntopng 		[mongoose.c:4534] ERROR: set_ports_option: cannot bind to 3000: Address already in use
40Nov 29 08:49:30 	php-fpm 		/rc.start_packages: Skipping STARTing packages process because previous/another instance is already running
41Nov 29 08:49:29 	php-fpm 		/rc.start_packages: Skipping STARTing packages process because previous/another instance is already running
42Nov 29 08:49:29 	check_reload_status 		Starting packages
43Nov 29 08:49:29 	php-fpm 	90622 	/rc.newwanip: pfSense package system has detected an IP change or dynamic WAN reconnection - 50.1.46.175 -> 50.1.46.175 - Restarting packages.
44Nov 29 08:49:28 	kernel 		arp: 192.168.70.8 moved from 40:49:0f:35:65:0d to 10:4f:a8:a6:cf:a5 on igb2
45Nov 29 08:49:28 	check_reload_status 		Starting packages
46Nov 29 08:49:28 	php-fpm 	91774 	/rc.newwanip: pfSense package system has detected an IP change or dynamic WAN reconnection - -> 192.168.2.1 - Restarting packages.
47Nov 29 08:49:28 	check_reload_status 		Reloading filter
48Nov 29 08:49:28 	php-fpm 	91774 	/rc.newwanip: rc.newwanip called with empty interface.
49Nov 29 08:49:28 	php-fpm 	91774 	/rc.newwanip: rc.newwanip: on (IP address: 192.168.2.1) (interface: []) (real interface: ovpns1).
50Nov 29 08:49:28 	php-fpm 	91774 	/rc.newwanip: rc.newwanip: Info: starting on ovpns1.
51Nov 29 08:49:27 	check_reload_status 		rc.newwanip starting ovpns1
52Nov 29 08:49:27 	php-fpm 	90622 	/rc.newwanip: Creating rrd update script
53Nov 29 08:49:27 	check_reload_status 		Reloading filter
54Nov 29 08:49:27 	php-fpm 	90622 	OpenVPN PID written: 66757
55Nov 29 08:49:27 	kernel 		ovpns1: link state changed to UP
56Nov 29 08:49:26 	check_reload_status 		Reloading filter
57Nov 29 08:49:26 	kernel 		ovpns1: link state changed to DOWN
58Nov 29 08:49:26 	avahi-daemon 	47202 	Withdrawing workstation service for ovpns1.
59Nov 29 08:49:26 	php-fpm 	90622 	OpenVPN terminate old pid: 76361
60Nov 29 08:49:26 	php-fpm 	90622 	/rc.newwanip: Resyncing OpenVPN instances for interface WAN.
61Nov 29 08:49:26 	kernel 		arp: 192.168.70.8 moved from 10:4f:a8:a6:cf:a5 to 40:49:0f:35:65:0d on igb2
62Nov 29 08:49:25 	php-fpm 	90622 	/rc.newwanip: phpDynDNS (): No change in my IP address and/or 25 days has not passed. Not updating dynamic DNS entry.
63Nov 29 08:49:25 	kernel 		pid 96960 (ntopng), uid 0: exited on signal 11 (core dumped)
64Nov 29 08:49:24 	php-fpm 	90622 	/rc.newwanip: phpDynDNS (chudak.no-ip.org): No change in my IP address and/or 25 days has not passed. Not updating dynamic DNS entry.
65Nov 29 08:49:23 	avahi-daemon 	47202 	Service "pfSense" (/usr/local/etc/avahi/services/sftp-ssh.service) successfully established.
66Nov 29 08:49:23 	avahi-daemon 	47202 	Service "pfSense" (/usr/local/etc/avahi/services/ssh.service) successfully established.
67Nov 29 08:49:22 	dhcpleases 		kqueue error: unkown
68Nov 29 08:49:22 	dhcpleases 		Could not deliver signal HUP to process because its pidfile (/var/run/unbound.pid) does not exist, No such process.
69Nov 29 08:49:22 	dhcpleases 		/etc/hosts changed size from original!
70Nov 29 08:49:21 	avahi-daemon 	47202 	Server startup complete. Host name is pfSense.local. Local service cookie is 392794104.
71Nov 29 08:49:21 	php-fpm 	183 	/rc.start_packages: Skipping STARTing packages process because previous/another instance is already running
72Nov 29 08:49:21 	avahi-daemon 	47121 	Failed to create PID file: File exists
73Nov 29 08:49:21 	avahi-daemon 	47121 	open(/var/run/avahi-daemon//pid): File exists
74Nov 29 08:49:21 	avahi-daemon 	47121 	Successfully dropped root privileges.
75Nov 29 08:49:21 	avahi-daemon 	47121 	Found user 'avahi' (UID 558) and group 'avahi' (GID 558).
76Nov 29 08:49:21 	avahi-daemon 	47202 	Registering HINFO record with values 'AMD64'/'FREEBSD'.
77Nov 29 08:49:21 	avahi-daemon 	47202 	Registering new address record for 192.168.90.1 on igb1.IPv4.
78Nov 29 08:49:21 	avahi-daemon 	47202 	Registering new address record for 10.10.10.1 on igb1.IPv4.
79Nov 29 08:49:21 	avahi-daemon 	47202 	Registering new address record for fe80::20e:c4ff:fed1:6f28 on igb1.*.
80Nov 29 08:49:21 	avahi-daemon 	47202 	Registering new address record for 192.168.70.1 on igb2.IPv4.
81Nov 29 08:49:21 	avahi-daemon 	47202 	Registering new address record for fe80::20e:c4ff:fed1:6f29 on igb2.*.
82Nov 29 08:49:21 	avahi-daemon 	47202 	Network interface enumeration completed.
83Nov 29 08:49:21 	avahi-daemon 	47202 	New relevant interface igb1.IPv4 for mDNS.
84Nov 29 08:49:21 	avahi-daemon 	47202 	Joining mDNS multicast group on interface igb1.IPv4 with address 10.10.10.1.
85Nov 29 08:49:21 	avahi-daemon 	47202 	New relevant interface igb2.IPv4 for mDNS.
86Nov 29 08:49:21 	avahi-daemon 	47202 	Joining mDNS multicast group on interface igb2.IPv4 with address 192.168.70.1.
87Nov 29 08:49:21 	avahi-daemon 	47202 	Loading service file /usr/local/etc/avahi/services/ssh.service.
88Nov 29 08:49:21 	avahi-daemon 	47202 	Loading service file /usr/local/etc/avahi/services/sftp-ssh.service.
89Nov 29 08:49:21 	avahi-daemon 	47202 	WARNING: No NSS support for mDNS detected, consider installing nss-mdns!
90Nov 29 08:49:21 	avahi-daemon 	47202 	avahi-daemon 0.7 starting up.
91Nov 29 08:49:21 	avahi-daemon 	47202 	Successfully dropped root privileges.
92Nov 29 08:49:21 	avahi-daemon 	47202 	Found user 'avahi' (UID 558) and group 'avahi' (GID 558).
93Nov 29 08:49:20 	avahi-daemon 	83509 	avahi-daemon 0.7 exiting.
94Nov 29 08:49:20 	avahi-daemon 	83509 	Leaving mDNS multicast group on interface igb1.IPv4 with address 10.10.10.1.
95Nov 29 08:49:20 	avahi-daemon 	83509 	Leaving mDNS multicast group on interface igb2.IPv4 with address 192.168.70.1.
96Nov 29 08:49:20 	php-fpm 	339 	/rc.start_packages: Starting service avahi
97Nov 29 08:49:20 	avahi-daemon 	83509 	Got SIGTERM, quitting.
98Nov 29 08:49:20 	php-fpm 	339 	/rc.start_packages: Stopping service avahi
99Nov 29 08:49:20 	php-fpm 	339 	/rc.start_packages: Restarting/Starting all packages.
100Nov 29 08:49:20 	check_reload_status 		Starting packages
101Nov 29 08:49:20 	php-fpm 	183 	/rc.newwanip: pfSense package system has detected an IP change or dynamic WAN reconnection - 50.1.46.175 -> 50.1.46.175 - Restarting packages.
102Nov 29 08:49:20 	php-fpm 	24796 	/rc.dyndns.update: phpDynDNS (): No change in my IP address and/or 25 days has not passed. Not updating dynamic DNS entry.
103Nov 29 08:49:20 	php-fpm 	90622 	/rc.newwanip: Gateway, none 'available' for inet6, use the first one configured. ''
104Nov 29 08:49:19 	check_reload_status 		Starting packages
105Nov 29 08:49:19 	php-fpm 	339 	/rc.newwanip: pfSense package system has detected an IP change or dynamic WAN reconnection - -> 192.168.2.1 - Restarting packages.
106Nov 29 08:49:19 	check_reload_status 		Reloading filter
107Nov 29 08:49:19 	php-fpm 	339 	/rc.newwanip: rc.newwanip called with empty interface.
108Nov 29 08:49:19 	php-fpm 	339 	/rc.newwanip: rc.newwanip: on (IP address: 192.168.2.1) (interface: []) (real interface: ovpns1).
109Nov 29 08:49:19 	php-fpm 	339 	/rc.newwanip: rc.newwanip: Info: starting on ovpns1.
110Nov 29 08:49:19 	php-fpm 	91774 	/rc.filter_configure_sync: dpinger: cannot connect to status socket /var/run/dpinger_WAN_DHCP~50.1.46.175~8.8.8.8.sock - No such file or directory (2)
111Nov 29 08:49:19 	php-fpm 	90622 	/rc.newwanip: Removing static route for monitor 8.8.8.8 and adding a new route through 50.1.44.1
112Nov 29 08:49:18 	check_reload_status 		rc.newwanip starting ovpns1
113Nov 29 08:49:18 	php-fpm 	183 	/rc.newwanip: Creating rrd update script
114Nov 29 08:49:18 	php-fpm 	183 	OpenVPN PID written: 76361
115Nov 29 08:49:18 	kernel 		ovpns1: link state changed to UP
116Nov 29 08:49:18 	check_reload_status 		Reloading filter
117Nov 29 08:49:18 	avahi-daemon 	83509 	Withdrawing workstation service for ovpns1.
118Nov 29 08:49:18 	kernel 		ovpns1: link state changed to DOWN
119Nov 29 08:49:18 	php-fpm 	183 	OpenVPN terminate old pid: 30125
120Nov 29 08:49:18 	php-fpm 	183 	/rc.newwanip: Resyncing OpenVPN instances for interface WAN.
121Nov 29 08:49:18 	php-fpm 	24796 	/rc.dyndns.update: phpDynDNS (chudak.no-ip.org): No change in my IP address and/or 25 days has not passed. Not updating dynamic DNS entry.
122Nov 29 08:49:17 	php-fpm 	183 	/rc.newwanip: phpDynDNS (): No change in my IP address and/or 25 days has not passed. Not updating dynamic DNS entry.
123Nov 29 08:49:17 	check_reload_status 		Reloading filter
124Nov 29 08:49:17 	check_reload_status 		updating dyndns wan
125Nov 29 08:49:16 	php-fpm 	183 	/rc.newwanip: phpDynDNS (chudak.no-ip.org): No change in my IP address and/or 25 days has not passed. Not updating dynamic DNS entry.
126Nov 29 08:49:15 	dhcpleases 		kqueue error: unkown
127Nov 29 08:49:15 	php-fpm 	339 	/rc.linkup: The command '/usr/local/sbin/unbound -c /var/unbound/unbound.conf' returned exit code '1', the output was '[1543510155] unbound[45931:0] error: bind: address already in use [1543510155] unbound[45931:0] fatal error: could not open ports'
128Nov 29 08:49:15 	dhcpleases 		kqueue error: unkown
129Nov 29 08:49:14 	dhcpleases 		Could not deliver signal HUP to process because its pidfile (/var/run/unbound.pid) does not exist, No such process.
130Nov 29 08:49:14 	dhcpleases 		/etc/hosts changed size from original!
131Nov 29 08:49:14 	dhcpleases 		Could not deliver signal HUP to process because its pidfile (/var/run/unbound.pid) does not exist, No such process.
132Nov 29 08:49:14 	dhcpleases 		/etc/hosts changed size from original!
133Nov 29 08:49:12 	dhcpleases 		Could not deliver signal HUP to process because its pidfile (/var/run/unbound.pid) does not exist, No such process.
134Nov 29 08:49:12 	dhcpleases 		/etc/hosts changed size from original!
135Nov 29 08:49:12 	php-fpm 	90622 	/rc.newwanip: rc.newwanip: on (IP address: 50.1.46.175) (interface: WAN[wan]) (real interface: igb0).
136Nov 29 08:49:12 	php-fpm 	90622 	/rc.newwanip: rc.newwanip: Info: starting on igb0.
137Nov 29 08:49:12 	php-fpm 	24796 	/rc.dyndns.update: Dynamic DNS () There was an error trying to determine the public IP for interface - wan (igb0 ).
138Nov 29 08:49:11 	check_reload_status 		Restarting ipsec tunnels
139Nov 29 08:49:11 	php-fpm 	339 	/rc.linkup: Gateway, none 'available' for inet6, use the first one configured. ''
140Nov 29 08:49:11 	check_reload_status 		rc.newwanip starting igb0
141Nov 29 08:49:11 	php-fpm 	24796 	/rc.dyndns.update: Dynamic DNS (chudak.no-ip.org) There was an error trying to determine the public IP for interface - wan (igb0 ).
142Nov 29 08:49:11 	php-fpm 	339 	/rc.linkup: HOTPLUG: Configuring interface wan
143Nov 29 08:49:11 	php-fpm 	339 	/rc.linkup: DEVD Ethernet attached event for wan
144Nov 29 08:49:11 	check_reload_status 		Reloading filter
145Nov 29 08:49:11 	php-fpm 	183 	/rc.newwanip: Gateway, none 'available' for inet6, use the first one configured. ''
146Nov 29 08:49:10 	php-fpm 	183 	/rc.newwanip: Removing static route for monitor 8.8.8.8 and adding a new route through 50.1.44.1
147Nov 29 08:49:10 	php-fpm 	340 	/rc.linkup: DEVD Ethernet detached event for wan
148Nov 29 08:49:10 	check_reload_status 		Reloading filter
149Nov 29 08:49:10 	check_reload_status 		updating dyndns wan
150Nov 29 08:49:09 	dhcpleases 		kqueue error: unkown
151Nov 29 08:49:09 	dhcpleases 		Could not deliver signal HUP to process because its pidfile (/var/run/unbound.pid) does not exist, No such process.
152Nov 29 08:49:09 	dhcpleases 		/etc/hosts changed size from original!
153Nov 29 08:49:08 	dhcpleases 		Could not deliver signal HUP to process because its pidfile (/var/run/unbound.pid) does not exist, No such process.
154Nov 29 08:49:08 	dhcpleases 		/etc/hosts changed size from original!
155Nov 29 08:49:08 	php-fpm 	183 	/rc.newwanip: rc.newwanip: on (IP address: 50.1.46.175) (interface: WAN[wan]) (real interface: igb0).
156Nov 29 08:49:08 	php-fpm 	183 	/rc.newwanip: rc.newwanip: Info: starting on igb0.
157Nov 29 08:49:07 	check_reload_status 		Restarting ipsec tunnels
158Nov 29 08:49:07 	php-fpm 	91774 	/rc.linkup: Gateway, none 'available' for inet6, use the first one configured. ''
159Nov 29 08:49:07 	php-fpm 	91774 	/rc.linkup: Default gateway setting Interface WAN_DHCP Gateway as default.
160Nov 29 08:49:07 	check_reload_status 		rc.newwanip starting igb0
161Nov 29 08:48:35 	check_reload_status 		Linkup starting igb0
162Nov 29 08:48:35 	kernel 		igb0: link state changed to UP
163Nov 29 08:48:31 	check_reload_status 		Linkup starting igb0
164Nov 29 08:48:31 	kernel 		igb0: link state changed to DOWN
165Nov 29 08:48:31 	avahi-daemon 	83509 	Withdrawing workstation service for igb0.
166Nov 29 08:48:03 	barnyard2 	74750 	Waiting for new data
167Nov 29 08:48:03 	barnyard2 	74750 	Opened spool file '/var/log/snort/snort_igb233777/snort_33777_igb2.u2.1543510078'
168Nov 29 08:48:03 	barnyard2 	74750 	Closing spool file '/var/log/snort/snort_igb233777/snort_33777_igb2.u2.1543509714'. Read 0 records
169Nov 29 08:48:03 	barnyard2 	74750 	Opened spool file '/var/log/snort/snort_igb233777/snort_33777_igb2.u2.1543509714'
170Nov 29 08:48:03 	barnyard2 	74750 	Closing spool file '/var/log/snort/snort_igb233777/snort_33777_igb2.u2.1543509525'. Read 0 records
171Nov 29 08:48:03 	barnyard2 	74750 	Opened spool file '/var/log/snort/snort_igb233777/snort_33777_igb2.u2.1543509525'
172Nov 29 08:48:03 	barnyard2 	74750 	Using waldo file '/var/log/snort/snort_igb233777/barnyard2/33777_igb2.waldo': spool directory = /var/log/snort/snort_igb233777 spool filebase = snort_33777_igb2.u2 time_stamp = 1543509525 record_idx = 0
173Nov 29 08:48:03 	barnyard2 	74750 	Barnyard2 initialization completed successfully (pid=74750)
174Nov 29 08:48:03 	barnyard2 	74750 	--== Initialization Complete ==--
175Nov 29 08:48:03 	barnyard2 	74750 	Writing PID "74750" to file "/var/run/barnyard2_igb233777.pid"
176Nov 29 08:48:03 	barnyard2 	74750 	PID path stat checked out ok, PID path set to /var/run
177Nov 29 08:48:03 	barnyard2 	74750 	Daemon initialized, signaled parent pid: 74497
178Nov 29 08:48:03 	barnyard2 	74497 	Daemon parent exiting
179Nov 29 08:48:03 	barnyard2 	74497 	Initializing daemon mode
180Nov 29 08:48:03 	barnyard2 	74497 	Configure syslog Priority : [LOG_INFO]
181Nov 29 08:48:03 	barnyard2 	74497 	Configure syslog Facility : [LOG_USER]
182Nov 29 08:48:03 	barnyard2 	74497 	Configured to log to local syslog
183Nov 29 08:48:03 	barnyard2 	74497 	Detail Level: Fast
184Nov 29 08:48:03 	barnyard2 	74497 	spo_syslog_full config:
185Nov 29 08:48:03 	barnyard2 	74497 	using operation_mode: default
186Nov 29 08:48:03 	barnyard2 	74497 	Local logging enabled, WILL NOT send information to a remote syslog
187Nov 29 08:48:03 	barnyard2 	74497 	Log directory = /var/log/snort/snort_igb233777
188Nov 29 08:48:03 	barnyard2 	74497 	Barnyard2 spooler: Event cache size set to [8192]
189Nov 29 08:48:03 	barnyard2 	74497 	WARNING: Ignoring bad line in SID file: 'www.talosintelligence.com/reports/TALOS-2018-0721/'
190Nov 29 08:48:03 	barnyard2 	74497 	WARNING: invalid Reference spec 'url,'. Ignored
191Nov 29 08:48:03 	barnyard2 	74497 	WARNING: Ignoring bad line in SID file: 'www.talosintelligence.com/reports/TALOS-2018-0721/'
192Nov 29 08:48:03 	barnyard2 	74497 	WARNING: invalid Reference spec 'url,'. Ignored
193Nov 29 08:48:01 	barnyard2 	74497 	WARNING: Ignoring bad line in SID file: '/TALOS-2017-0350/ || url,www.talosintelligence.com/reports/TALOS-2017-0351/ || url,www.talosintelligence.com/reports/TALOS-2017-0380/'
194Nov 29 08:48:01 	barnyard2 	74497 	WARNING: Ignoring bad line in SID file: '/TALOS-2017-0350/ || url,www.talosintelligence.com/reports/TALOS-2017-0351/ || url,www.talosintelligence.com/reports/TALOS-2017-0380/'
195Nov 29 08:48:01 	barnyard2 	74497 	WARNING: Ignoring bad line in SID file: '/TALOS-2017-0350/ || url,www.talosintelligence.com/reports/TALOS-2017-0351/ || url,www.talosintelligence.com/reports/TALOS-2017-0380/'
196Nov 29 08:48:00 	barnyard2 	74497 	---------------------------- +[ Signature Suppress list ]+
197Nov 29 08:48:00 	barnyard2 	74497 	+[No entry in Signature Suppress List]+
198Nov 29 08:48:00 	barnyard2 	74497 	+[ Signature Suppress list ]+ ----------------------------
199Nov 29 08:48:00 	barnyard2 	74497 	Found pid path directive (/var/run)
200Nov 29 08:48:00 	barnyard2 	74497 	Parsing config file "/usr/local/etc/snort/snort_33777_igb2/barnyard2.conf"
201Nov 29 08:48:00 	barnyard2 	74497 	Initializing Output Plugins!
202Nov 29 08:48:00 	barnyard2 	74497 	Initializing Input Plugins!
203Nov 29 08:48:00 	barnyard2 	74497 	--== Initializing Barnyard2 ==--
204Nov 29 08:48:00 	barnyard2 	74497 	Running in Continuous mode
205Nov 29 08:48:00 	barnyard2 	74497 	Found pid path directive (/var/run)
206Nov 29 08:48:00 	SnortStartup 	74495 	Barnyard2 START for WIFI snort protect (33777_igb2)...
207Nov 29 08:47:50 	login 		login on ttyv0 as root
208Nov 29 08:47:49 	php-fpm 	91774 	/rc.linkup: HOTPLUG: Configuring interface wan
209Nov 29 08:47:49 	php-fpm 	91774 	/rc.linkup: DEVD Ethernet attached event for wan
210Nov 29 08:47:49 	php 		[pfBlockerNG] DNSBL parser daemon started
211Nov 29 08:47:49 	php_pfb 		[pfBlockerNG] filterlog daemon started
212Nov 29 08:47:49 	php_pfb 		[pfBlockerNG] filterlog daemon started
213Nov 29 08:47:48 	php-fpm 	339 	[pfBlockerNG] Starting firewall filter daemon
214Nov 29 08:47:48 	check_reload_status 		Linkup starting igb0
215Nov 29 08:47:48 	kernel 		igb0: link state changed to UP
216Nov 29 08:47:47 	SnortStartup 	27023 	Snort START for WIFI snort protect (33777_igb2)...
217Nov 29 08:47:47 	barnyard2 	26011 	Waiting for new data
218Nov 29 08:47:47 	barnyard2 	26011 	Opened spool file '/var/log/snort/snort_igb117559/snort_17559_igb1.u2.1543510060'
219Nov 29 08:47:47 	barnyard2 	26011 	Closing spool file '/var/log/snort/snort_igb117559/snort_17559_igb1.u2.1543509698'. Read 0 records
220Nov 29 08:47:47 	barnyard2 	26011 	Opened spool file '/var/log/snort/snort_igb117559/snort_17559_igb1.u2.1543509698'
221Nov 29 08:47:47 	barnyard2 	26011 	Using waldo file '/var/log/snort/snort_igb117559/barnyard2/17559_igb1.waldo': spool directory = /var/log/snort/snort_igb117559 spool filebase = snort_17559_igb1.u2 time_stamp = 1543509698 record_idx = 0
222Nov 29 08:47:47 	barnyard2 	26011 	Barnyard2 initialization completed successfully (pid=26011)
223Nov 29 08:47:47 	barnyard2 	26011 	--== Initialization Complete ==--
224Nov 29 08:47:47 	barnyard2 	26011 	Writing PID "26011" to file "/var/run/barnyard2_igb117559.pid"
225Nov 29 08:47:47 	barnyard2 	26011 	PID path stat checked out ok, PID path set to /var/run
226Nov 29 08:47:47 	barnyard2 	26011 	Daemon initialized, signaled parent pid: 1415
227Nov 29 08:47:47 	barnyard2 	1415 	Daemon parent exiting
228Nov 29 08:47:47 	barnyard2 	1415 	Initializing daemon mode
229Nov 29 08:47:47 	barnyard2 	1415 	Configure syslog Priority : [LOG_INFO]
230Nov 29 08:47:47 	barnyard2 	1415 	Configure syslog Facility : [LOG_USER]
231Nov 29 08:47:47 	barnyard2 	1415 	Configured to log to local syslog
232Nov 29 08:47:47 	barnyard2 	1415 	Detail Level: Fast
233Nov 29 08:47:47 	barnyard2 	1415 	spo_syslog_full config:
234Nov 29 08:47:47 	barnyard2 	1415 	using operation_mode: default
235Nov 29 08:47:47 	barnyard2 	1415 	Local logging enabled, WILL NOT send information to a remote syslog
236Nov 29 08:47:47 	barnyard2 	1415 	Log directory = /var/log/snort/snort_igb117559
237Nov 29 08:47:47 	barnyard2 	1415 	Barnyard2 spooler: Event cache size set to [8192]
238Nov 29 08:47:47 	barnyard2 	1415 	WARNING: Ignoring bad line in SID file: 'www.talosintelligence.com/reports/TALOS-2018-0721/'
239Nov 29 08:47:47 	barnyard2 	1415 	WARNING: invalid Reference spec 'url,'. Ignored
240Nov 29 08:47:47 	barnyard2 	1415 	WARNING: Ignoring bad line in SID file: 'www.talosintelligence.com/reports/TALOS-2018-0721/'
241Nov 29 08:47:47 	barnyard2 	1415 	WARNING: invalid Reference spec 'url,'. Ignored
242Nov 29 08:47:44 	php 		[pfBlockerNG] DNSBL parser daemon started
243Nov 29 08:47:44 	ntopng 		[HTTPserver.cpp:923] ERROR: Unable to start HTTP server (IPv4) on ports 3000
244Nov 29 08:47:44 	ntopng 		[mongoose.c:4534] ERROR: set_ports_option: cannot bind to 3000: Address already in use
245Nov 29 08:47:43 	barnyard2 	1415 	WARNING: Ignoring bad line in SID file: '/TALOS-2017-0350/ || url,www.talosintelligence.com/reports/TALOS-2017-0351/ || url,www.talosintelligence.com/reports/TALOS-2017-0380/'
246Nov 29 08:47:43 	barnyard2 	1415 	WARNING: Ignoring bad line in SID file: '/TALOS-2017-0350/ || url,www.talosintelligence.com/reports/TALOS-2017-0351/ || url,www.talosintelligence.com/reports/TALOS-2017-0380/'
247Nov 29 08:47:43 	barnyard2 	1415 	WARNING: Ignoring bad line in SID file: '/TALOS-2017-0350/ || url,www.talosintelligence.com/reports/TALOS-2017-0351/ || url,www.talosintelligence.com/reports/TALOS-2017-0380/'
248Nov 29 08:47:43 	barnyard2 	1415 	---------------------------- +[ Signature Suppress list ]+
249Nov 29 08:47:43 	barnyard2 	1415 	+[No entry in Signature Suppress List]+
250Nov 29 08:47:43 	barnyard2 	1415 	+[ Signature Suppress list ]+ ----------------------------
251Nov 29 08:47:43 	barnyard2 	1415 	Found pid path directive (/var/run)
252Nov 29 08:47:43 	barnyard2 	1415 	Parsing config file "/usr/local/etc/snort/snort_17559_igb1/barnyard2.conf"
253Nov 29 08:47:43 	barnyard2 	1415 	Initializing Output Plugins!
254Nov 29 08:47:43 	barnyard2 	1415 	Initializing Input Plugins!
255Nov 29 08:47:43 	barnyard2 	1415 	--== Initializing Barnyard2 ==--
256Nov 29 08:47:43 	barnyard2 	1415 	Running in Continuous mode
257Nov 29 08:47:43 	barnyard2 	1415 	Found pid path directive (/var/run)
258Nov 29 08:47:43 	SnortStartup 	1266 	Barnyard2 START for LAN snort protect (17559_igb1)...
259Nov 29 08:47:31 	barnyard2 	99818 	Waiting for new data
260Nov 29 08:47:31 	barnyard2 	99818 	Opened spool file '/var/log/snort/snort_igb015376/snort_15376_igb0.u2.1543510047'
261Nov 29 08:47:31 	barnyard2 	99818 	Closing spool file '/var/log/snort/snort_igb015376/snort_15376_igb0.u2.1543509685'. Read 0 records
262Nov 29 08:47:31 	SnortStartup 	365 	Snort START for LAN snort protect (17559_igb1)...
263Nov 29 08:47:31 	barnyard2 	99818 	Opened spool file '/var/log/snort/snort_igb015376/snort_15376_igb0.u2.1543509685'
264Nov 29 08:47:31 	barnyard2 	99818 	Using waldo file '/var/log/snort/snort_igb015376/barnyard2/15376_igb0.waldo': spool directory = /var/log/snort/snort_igb015376 spool filebase = snort_15376_igb0.u2 time_stamp = 1543509685 record_idx = 0
265Nov 29 08:47:31 	barnyard2 	99818 	Barnyard2 initialization completed successfully (pid=99818)
266Nov 29 08:47:31 	barnyard2 	99818 	--== Initialization Complete ==--
267Nov 29 08:47:31 	barnyard2 	99818 	Writing PID "99818" to file "/var/run/barnyard2_igb015376.pid"
268Nov 29 08:47:31 	barnyard2 	99818 	PID path stat checked out ok, PID path set to /var/run
269Nov 29 08:47:31 	barnyard2 	99818 	Daemon initialized, signaled parent pid: 99675
270Nov 29 08:47:31 	barnyard2 	99675 	Daemon parent exiting
271Nov 29 08:47:31 	barnyard2 	99675 	Initializing daemon mode
272Nov 29 08:47:31 	barnyard2 	99675 	Configure syslog Priority : [LOG_INFO]
273Nov 29 08:47:31 	barnyard2 	99675 	Configure syslog Facility : [LOG_USER]
274Nov 29 08:47:31 	barnyard2 	99675 	Configured to log to local syslog
275Nov 29 08:47:31 	barnyard2 	99675 	Detail Level: Fast
276Nov 29 08:47:31 	barnyard2 	99675 	spo_syslog_full config:
277Nov 29 08:47:31 	barnyard2 	99675 	using operation_mode: default
278Nov 29 08:47:31 	barnyard2 	99675 	Local logging enabled, WILL NOT send information to a remote syslog
279Nov 29 08:47:31 	barnyard2 	99675 	Log directory = /var/log/snort/snort_igb015376
280Nov 29 08:47:31 	barnyard2 	99675 	Barnyard2 spooler: Event cache size set to [8192]
281Nov 29 08:47:29 	barnyard2 	99675 	---------------------------- +[ Signature Suppress list ]+
282Nov 29 08:47:29 	barnyard2 	99675 	+[No entry in Signature Suppress List]+
283Nov 29 08:47:29 	barnyard2 	99675 	+[ Signature Suppress list ]+ ----------------------------
284Nov 29 08:47:29 	barnyard2 	99675 	Found pid path directive (/var/run)
285Nov 29 08:47:29 	barnyard2 	99675 	Parsing config file "/usr/local/etc/snort/snort_15376_igb0/barnyard2.conf"
286Nov 29 08:47:29 	barnyard2 	99675 	Initializing Output Plugins!
287Nov 29 08:47:29 	barnyard2 	99675 	Initializing Input Plugins!
288Nov 29 08:47:29 	barnyard2 	99675 	--== Initializing Barnyard2 ==--
289Nov 29 08:47:29 	barnyard2 	99675 	Running in Continuous mode
290Nov 29 08:47:29 	barnyard2 	99675 	Found pid path directive (/var/run)
291Nov 29 08:47:29 	SnortStartup 	99394 	Barnyard2 START for WAN snort protect(15376_igb0)...
292Nov 29 08:47:24 	kernel 		igb0: promiscuous mode enabled
293Nov 29 08:47:24 	kernel 		igb2: promiscuous mode enabled
294Nov 29 08:47:24 	kernel 		igb1: promiscuous mode enabled
295Nov 29 08:47:20 	avahi-daemon 	83509 	Service "pfSense" (/usr/local/etc/avahi/services/sftp-ssh.service) successfully established.
296Nov 29 08:47:20 	avahi-daemon 	83509 	Service "pfSense" (/usr/local/etc/avahi/services/ssh.service) successfully established.
297Nov 29 08:47:19 	avahi-daemon 	83509 	Server startup complete. Host name is pfSense.local. Local service cookie is 500782976.
298Nov 29 08:47:19 	avahi-daemon 	83221 	Failed to create PID file: File exists
299Nov 29 08:47:19 	avahi-daemon 	83221 	open(/var/run/avahi-daemon//pid): File exists
300Nov 29 08:47:19 	avahi-daemon 	83221 	Successfully dropped root privileges.
301Nov 29 08:47:19 	avahi-daemon 	83221 	Found user 'avahi' (UID 558) and group 'avahi' (GID 558).
302Nov 29 08:47:19 	avahi-daemon 	83509 	Registering HINFO record with values 'AMD64'/'FREEBSD'.
303Nov 29 08:47:19 	avahi-daemon 	83509 	Registering new address record for 192.168.90.1 on igb1.IPv4.
304Nov 29 08:47:19 	avahi-daemon 	83509 	Registering new address record for 10.10.10.1 on igb1.IPv4.
305Nov 29 08:47:19 	avahi-daemon 	83509 	Registering new address record for fe80::20e:c4ff:fed1:6f28 on igb1.*.
306Nov 29 08:47:19 	avahi-daemon 	83509 	Registering new address record for 192.168.70.1 on igb2.IPv4.
307Nov 29 08:47:19 	avahi-daemon 	83509 	Registering new address record for fe80::20e:c4ff:fed1:6f29 on igb2.*.
308Nov 29 08:47:19 	avahi-daemon 	83509 	Network interface enumeration completed.
309Nov 29 08:47:19 	avahi-daemon 	83509 	New relevant interface igb1.IPv4 for mDNS.
310Nov 29 08:47:19 	avahi-daemon 	83509 	Joining mDNS multicast group on interface igb1.IPv4 with address 10.10.10.1.
311Nov 29 08:47:19 	avahi-daemon 	83509 	New relevant interface igb2.IPv4 for mDNS.
312Nov 29 08:47:19 	avahi-daemon 	83509 	Joining mDNS multicast group on interface igb2.IPv4 with address 192.168.70.1.
313Nov 29 08:47:19 	avahi-daemon 	83509 	Loading service file /usr/local/etc/avahi/services/ssh.service.
314Nov 29 08:47:19 	avahi-daemon 	83509 	Loading service file /usr/local/etc/avahi/services/sftp-ssh.service.
315Nov 29 08:47:19 	avahi-daemon 	83509 	WARNING: No NSS support for mDNS detected, consider installing nss-mdns!
316Nov 29 08:47:19 	avahi-daemon 	83509 	avahi-daemon 0.7 starting up.
317Nov 29 08:47:19 	avahi-daemon 	83509 	Successfully dropped root privileges.
318Nov 29 08:47:19 	avahi-daemon 	83509 	Found user 'avahi' (UID 558) and group 'avahi' (GID 558).
319Nov 29 08:47:19 	php-fpm 	339 	/rc.start_packages: Starting service avahi
320Nov 29 08:47:18 	SnortStartup 	80983 	Snort START for WAN snort protect(15376_igb0)...
321Nov 29 08:47:18 	php-fpm 	339 	/rc.start_packages: Restarting/Starting all packages.
322Nov 29 08:47:18 	kernel 		done.
323Nov 29 08:47:18 	syslogd 		kernel boot file is /boot/kernel/kernel
324Nov 29 08:47:18 	syslogd 		exiting on signal 15
325Nov 29 08:47:16 	root 		/etc/rc.d/hostid: WARNING: hostid: unable to figure out a UUID from DMI data, generating a new one
326Nov 29 08:47:16 	kernel 		done.
327Nov 29 08:47:16 	php-cgi 		rc.bootup: Creating rrd update script
328Nov 29 08:47:11 	kernel 		done.
329Nov 29 08:47:11 	kernel 		.
330Nov 29 08:47:11 	php-fpm 	340 	/rc.dyndns.update: Dynamic DNS () There was an error trying to determine the public IP for interface - wan (igb0 ).
331Nov 29 08:47:10 	php-fpm 	340 	/rc.dyndns.update: Dynamic DNS (chudak.no-ip.org) There was an error trying to determine the public IP for interface - wan (igb0 ).
332Nov 29 08:47:09 	kernel 		.....
333Nov 29 08:47:09 	check_reload_status 		Updating all dyndns
334Nov 29 08:47:09 	dhcpleases 		kqueue error: unkown
335Nov 29 08:47:09 	check_reload_status 		Linkup starting igb2
336Nov 29 08:47:09 	kernel 		igb2: link state changed to UP
337Nov 29 08:47:08 	kernel 		done.
338Nov 29 08:47:08 	php-cgi 		rc.bootup: NTPD is starting up.
339Nov 29 08:47:08 	kernel 		igb1: link state changed to UP
340Nov 29 08:47:08 	check_reload_status 		Linkup starting igb1
341Nov 29 08:47:07 	kernel 		done.
342Nov 29 08:47:07 	kernel 		done.
343Nov 29 08:47:07 	php-cgi 		rc.bootup: sync unbound done.
344Nov 29 08:47:06 	kernel 		.done.
345Nov 29 08:47:06 	php-cgi 		rc.bootup: Gateway, none 'available' for inet6, use the first one configured. ''
346Nov 29 08:47:05 	php-fpm 	340 	/rc.newwanip: rc.newwanip: on (IP address: 192.168.2.1) (interface: []) (real interface: ovpns1).
347Nov 29 08:47:05 	php-fpm 	340 	/rc.newwanip: rc.newwanip: Info: starting on ovpns1.
348Nov 29 08:47:04 	kernel 		....
349Nov 29 08:47:04 	check_reload_status 		rc.newwanip starting ovpns1
350Nov 29 08:47:04 	kernel 		pflog0: promiscuous mode enabled
351Nov 29 08:47:04 	kernel 		ovpns1: link state changed to UP
352Nov 29 08:47:04 	kernel 		tun1: changing name to 'ovpns1'
353Nov 29 08:47:04 	kernel 		done.
354Nov 29 08:47:04 	php-cgi 		rc.bootup: Resyncing OpenVPN instances.
355Nov 29 08:47:04 	php-cgi 		rc.bootup: The command '/sbin/dhclient -c /var/etc/dhclient_wan.conf igb0 > /tmp/igb0_output 2> /tmp/igb0_error_output' returned exit code '1', the output was ''
356Nov 29 08:46:54 	syslogd 		Logging subprocess 7648 (exec /usr/local/sbin/sshguard) exited due to signal 15.
357Nov 29 08:46:54 	sshd 	7577 	Server listening on 0.0.0.0 port 22.
358Nov 29 08:46:54 	sshd 	7577 	Server listening on :: port 22.
359Nov 29 08:46:52 	kernel 		coretemp3: <CPU On-Die Thermal Sensors> on cpu3
360Nov 29 08:46:52 	kernel 		coretemp2: <CPU On-Die Thermal Sensors> on cpu2
361Nov 29 08:46:52 	kernel 		coretemp1: <CPU On-Die Thermal Sensors> on cpu1
362Nov 29 08:46:52 	kernel 		coretemp0: <CPU On-Die Thermal Sensors> on cpu0
363Nov 29 08:46:52 	kernel 		aesni0: <AES-CBC,AES-XTS,AES-GCM,AES-ICM> on motherboard
364Nov 29 08:46:52 	kernel 		padlock0: No ACE support.
365Nov 29 08:46:52 	kernel 		TSC: P-state invariant, performance statistics
366Nov 29 08:46:52 	kernel 		VT-x: PAT,HLT,MTF,PAUSE,EPT,UG,VPID
367Nov 29 08:46:52 	kernel 		XSAVE Features=0x1<XSAVEOPT>
368Nov 29 08:46:52 	kernel 		Structured Extended Features3=0x9c000000<IBPB,STIBP,SSBD>
369Nov 29 08:46:52 	kernel 		Structured Extended Features=0x21c27ab<FSGSBASE,TSCADJ,BMI1,AVX2,SMEP,BMI2,ERMS,INVPCID,NFPUSG,RDSEED,ADX,SMAP,PROCTRACE>
370Nov 29 08:46:52 	kernel 		AMD Features2=0x121<LAHF,ABM,Prefetch>
371Nov 29 08:46:52 	kernel 		AMD Features=0x2c100800<SYSCALL,NX,Page1GB,RDTSCP,LM>
372Nov 29 08:46:52 	kernel 		Features2=0x7ffafbbf<SSE3,PCLMULQDQ,DTES64,MON,DS_CPL,VMX,EST,TM2,SSSE3,SDBG,FMA,CX16,xTPR,PDCM,PCID,SSE4.1,SSE4.2,x2APIC,MOVBE,POPCNT,TSCDLT,AESNI,XSAVE,OSXSAVE,AVX,F16C,RDRAND>
373Nov 29 08:46:52 	kernel 		Features=0xbfebfbff<FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,CLFLUSH,DTS,ACPI,MMX,FXSR,SSE,SSE2,SS,HTT,TM,PBE>
374Nov 29 08:46:52 	kernel 		Origin="GenuineIntel" Id=0x306d4 Family=0x6 Model=0x3d Stepping=4
375Nov 29 08:46:52 	kernel 		CPU: Intel(R) Core(TM) i5-5250U CPU @ 1.60GHz (1596.34-MHz K8-class CPU)
376Nov 29 08:46:52 	kernel 		random: unblocking device.
377Nov 29 08:46:52 	kernel 		Trying to mount root from ufs:/dev/ufsid/593033af52fded36 [rw]...
378Nov 29 08:46:52 	kernel 		ada0: 28626MB (58626288 512 byte sectors)
379Nov 29 08:46:52 	kernel 		ada0: Command Queueing enabled
380Nov 29 08:46:52 	kernel 		ada0: 600.000MB/s transfers (SATA 3.x, UDMA6, PIO 8192bytes)
381Nov 29 08:46:52 	kernel 		ada0: Serial Number CVLI613001ZZ030H
382Nov 29 08:46:52 	kernel 		ada0: <INTEL SSDMCEAC030B3 LLLi> ACS-2 ATA SATA 3.x device
383Nov 29 08:46:52 	kernel 		ada0 at ahcich0 bus 0 scbus0 target 0 lun 0
384Nov 29 08:46:52 	kernel 		uhub2: 8 ports with 8 removable, self powered
385Nov 29 08:46:52 	kernel 		uhub2: <vendor 0x8087 product 0x8001, class 9/0, rev 2.00/0.03, addr 2> on usbus1
386Nov 29 08:46:52 	kernel 		uhub2 on uhub1
387Nov 29 08:46:52 	kernel 		ugen1.2: <vendor 0x8087 product 0x8001> at usbus1
388Nov 29 08:46:52 	kernel 		uhub1: 2 ports with 2 removable, self powered
389Nov 29 08:46:52 	kernel 		uhub0: 15 ports with 15 removable, self powered
390Nov 29 08:46:52 	kernel 		uhub1: <Intel EHCI root HUB, class 9/0, rev 2.00/1.00, addr 1> on usbus1
391Nov 29 08:46:52 	kernel 		uhub0: <0x8086 XHCI root HUB, class 9/0, rev 3.00/1.00, addr 1> on usbus0
392Nov 29 08:46:52 	kernel 		ugen1.1: <Intel EHCI root HUB> at usbus1
393Nov 29 08:46:52 	kernel 		ugen0.1: <0x8086 XHCI root HUB> at usbus0
394Nov 29 08:46:52 	kernel 		pcm1: <Realtek ALC662 (Analog 2.0+HP/2.0)> at nid 20,27 and 24,25 on hdaa1
395Nov 29 08:46:52 	kernel 		hdaa1: No presence detection support at nid 27
396Nov 29 08:46:52 	kernel 		hdaa1: <Realtek ALC662 Audio Function Group> at nid 1 on hdacc1
397Nov 29 08:46:52 	kernel 		hdacc1: <Realtek ALC662 HDA CODEC> at cad 0 on hdac1
398Nov 29 08:46:52 	kernel 		pcm0: <Intel Broadwell (HDMI/DP 8ch)> at nid 3 on hdaa0
399Nov 29 08:46:52 	kernel 		hdaa0: <Intel Broadwell Audio Function Group> at nid 1 on hdacc0
400Nov 29 08:46:52 	kernel 		hdacc0: <Intel Broadwell HDA CODEC> at cad 0 on hdac0
401Nov 29 08:46:52 	kernel 		Timecounters tick every 1.000 msec
402Nov 29 08:46:52 	kernel 		est3: <Enhanced SpeedStep Frequency Control> on cpu3
403Nov 29 08:46:52 	kernel 		est2: <Enhanced SpeedStep Frequency Control> on cpu2
404Nov 29 08:46:52 	kernel 		est1: <Enhanced SpeedStep Frequency Control> on cpu1
405Nov 29 08:46:52 	kernel 		est0: <Enhanced SpeedStep Frequency Control> on cpu0
406Nov 29 08:46:52 	kernel 		ppc0: cannot reserve I/O port range
407Nov 29 08:46:52 	kernel 		atkbd0: [GIANT-LOCKED]
408Nov 29 08:46:52 	kernel 		kbd0 at atkbd0
409Nov 29 08:46:52 	kernel 		atkbd0: <AT Keyboard> irq 1 on atkbdc0
410Nov 29 08:46:52 	kernel 		atkbdc0: <Keyboard controller (i8042)> at port 0x60,0x64 on isa0
411Nov 29 08:46:52 	kernel 		vga0: <Generic ISA VGA> at port 0x3c0-0x3df iomem 0xa0000-0xbffff on isa0
412Nov 29 08:46:52 	kernel 		uart1: <16950 or compatible> port 0x2f8-0x2ff irq 3 on acpi0
413Nov 29 08:46:52 	kernel 		uart0: console (115200,n,8,1)
414Nov 29 08:46:52 	kernel 		uart0: <16950 or compatible> port 0x3f8-0x3ff irq 4 flags 0x10 on acpi0
415Nov 29 08:46:52 	kernel 		acpi_tz1: <Thermal Zone> on acpi0
416Nov 29 08:46:52 	kernel 		acpi_tz0: <Thermal Zone> on acpi0
417Nov 29 08:46:52 	kernel 		acpi_button1: <Power Button> on acpi0
418Nov 29 08:46:52 	kernel 		acpi_button0: <Sleep Button> on acpi0
419Nov 29 08:46:52 	kernel 		ahcich0: <AHCI channel> at channel 0 on ahci0
420Nov 29 08:46:52 	kernel 		ahci0: AHCI v1.30 with 4 6Gbps ports, Port Multiplier not supported
421Nov 29 08:46:52 	kernel 		ahci0: <AHCI SATA controller> port 0xf0b0-0xf0b7,0xf0a0-0xf0a3,0xf090-0xf097,0xf080-0xf083,0xf060-0xf07f mem 0xf7419000-0xf74197ff irq 19 at device 31.2 on pci0
422Nov 29 08:46:52 	kernel 		isa0: <ISA bus> on isab0
423Nov 29 08:46:52 	kernel 		isab0: <PCI-ISA bridge> at device 31.0 on pci0
424Nov 29 08:46:52 	kernel 		usbus1: 480Mbps High Speed USB v2.0
425Nov 29 08:46:52 	kernel 		usbus1 on ehci0
426Nov 29 08:46:52 	kernel 		usbus1: EHCI version 1.0
427Nov 29 08:46:52 	kernel 		ehci0: <EHCI (generic) USB 2.0 controller> mem 0xf741a000-0xf741a3ff irq 23 at device 29.0 on pci0
428Nov 29 08:46:52 	kernel 		igb3: netmap queues/slots: TX 2/1024, RX 2/1024
429Nov 29 08:46:52 	kernel 		igb3: Bound queue 1 to cpu 3
430Nov 29 08:46:52 	kernel 		igb3: Bound queue 0 to cpu 2
431Nov 29 08:46:52 	kernel 		igb3: Ethernet address: 00:0e:c4:d1:6f:2a
432Nov 29 08:46:52 	kernel 		igb3: Using MSIX interrupts with 3 vectors
433Nov 29 08:46:52 	kernel 		igb3: <Intel(R) PRO/1000 Network Connection, Version - 2.5.3-k> port 0xb000-0xb01f mem 0xf7000000-0xf701ffff,0xf7020000-0xf7023fff irq 16 at device 0.0 on pci4
434Nov 29 08:46:52 	kernel 		pci4: <ACPI PCI bus> on pcib4
435Nov 29 08:46:52 	kernel 		pcib4: <ACPI PCI-PCI bridge> irq 16 at device 28.4 on pci0
436Nov 29 08:46:52 	kernel 		igb2: netmap queues/slots: TX 2/1024, RX 2/1024
437Nov 29 08:46:52 	kernel 		igb2: Bound queue 1 to cpu 1
438Nov 29 08:46:52 	kernel 		igb2: Bound queue 0 to cpu 0
439Nov 29 08:46:52 	kernel 		igb2: Ethernet address: 00:0e:c4:d1:6f:29
440Nov 29 08:46:52 	kernel 		igb2: Using MSIX interrupts with 3 vectors
441Nov 29 08:46:52 	kernel 		igb2: <Intel(R) PRO/1000 Network Connection, Version - 2.5.3-k> port 0xc000-0xc01f mem 0xf7100000-0xf711ffff,0xf7120000-0xf7123fff irq 18 at device 0.0 on pci3
442Nov 29 08:46:52 	kernel 		pci3: <ACPI PCI bus> on pcib3
443Nov 29 08:46:52 	kernel 		pcib3: <ACPI PCI-PCI bridge> irq 18 at device 28.2 on pci0
444Nov 29 08:46:52 	kernel 		igb1: netmap queues/slots: TX 2/1024, RX 2/1024
445Nov 29 08:46:52 	kernel 		igb1: Bound queue 1 to cpu 3
446Nov 29 08:46:52 	kernel 		igb1: Bound queue 0 to cpu 2
447Nov 29 08:46:52 	kernel 		igb1: Ethernet address: 00:0e:c4:d1:6f:28
448Nov 29 08:46:52 	kernel 		igb1: Using MSIX interrupts with 3 vectors
449Nov 29 08:46:52 	kernel 		igb1: <Intel(R) PRO/1000 Network Connection, Version - 2.5.3-k> port 0xd000-0xd01f mem 0xf7200000-0xf721ffff,0xf7220000-0xf7223fff irq 17 at device 0.0 on pci2
450Nov 29 08:46:52 	kernel 		pci2: <ACPI PCI bus> on pcib2
451Nov 29 08:46:52 	kernel 		pcib2: <ACPI PCI-PCI bridge> irq 17 at device 28.1 on pci0
452Nov 29 08:46:52 	kernel 		igb0: netmap queues/slots: TX 2/1024, RX 2/1024
453Nov 29 08:46:52 	kernel 		igb0: Bound queue 1 to cpu 1
454Nov 29 08:46:52 	kernel 		igb0: Bound queue 0 to cpu 0
455Nov 29 08:46:52 	kernel 		igb0: Ethernet address: 00:0e:c4:d1:6f:27
456Nov 29 08:46:52 	kernel 		igb0: Using MSIX interrupts with 3 vectors
457Nov 29 08:46:52 	kernel 		igb0: <Intel(R) PRO/1000 Network Connection, Version - 2.5.3-k> port 0xe000-0xe01f mem 0xf7300000-0xf731ffff,0xf7320000-0xf7323fff irq 16 at device 0.0 on pci1
458Nov 29 08:46:52 	kernel 		pci1: <ACPI PCI bus> on pcib1
459Nov 29 08:46:52 	kernel 		pcib1: <ACPI PCI-PCI bridge> irq 16 at device 28.0 on pci0
460Nov 29 08:46:52 	kernel 		hdac1: <Intel Broadwell HDA Controller> mem 0xf7410000-0xf7413fff irq 22 at device 27.0 on pci0
461Nov 29 08:46:52 	kernel 		pci0: <simple comms> at device 22.0 (no driver attached)
462Nov 29 08:46:52 	kernel 		usbus0: 5.0Gbps Super Speed USB v3.0
463Nov 29 08:46:52 	kernel 		usbus0 on xhci0
464Nov 29 08:46:52 	kernel 		xhci0: Port routing mask set to 0xffffffff
465Nov 29 08:46:52 	kernel 		xhci0: 32 bytes context size, 64-bit DMA
466Nov 29 08:46:52 	kernel 		xhci0: <Broadwell Integrated PCH-LP chipset USB 3.0 controller> mem 0xf7400000-0xf740ffff irq 21 at device 20.0 on pci0
467Nov 29 08:46:52 	kernel 		hdac0: <Intel Broadwell HDA Controller> mem 0xf7414000-0xf7417fff irq 16 at device 3.0 on pci0
468Nov 29 08:46:52 	kernel 		vgapci0: Boot video device
469Nov 29 08:46:52 	kernel 		vgapci0: <VGA-compatible display> port 0xf000-0xf03f mem 0xf6000000-0xf6ffffff,0xe0000000-0xefffffff irq 16 at device 2.0 on pci0
470Nov 29 08:46:52 	kernel 		pci0: <ACPI PCI bus> on pcib0
471Nov 29 08:46:52 	kernel 		pcib0: <ACPI Host-PCI bridge> port 0xcf8-0xcff on acpi0
472Nov 29 08:46:52 	kernel 		acpi_timer0: <24-bit timer at 3.579545MHz> port 0x1808-0x180b on acpi0
473Nov 29 08:46:52 	kernel 		Timecounter "ACPI-fast" frequency 3579545 Hz quality 900
474Nov 29 08:46:52 	kernel 		Event timer "i8254" frequency 1193182 Hz quality 100
475Nov 29 08:46:52 	kernel 		Timecounter "i8254" frequency 1193182 Hz quality 0
476Nov 29 08:46:52 	kernel 		attimer0: <AT timer> port 0x40-0x43,0x50-0x53 irq 0 on acpi0
477Nov 29 08:46:52 	kernel 		Event timer "RTC" frequency 32768 Hz quality 0
478Nov 29 08:46:52 	kernel 		atrtc0: registered as a time-of-day clock, resolution 1.000000s
479Nov 29 08:46:52 	kernel 		atrtc0: Warning: Couldn't map I/O.
480Nov 29 08:46:52 	kernel 		atrtc0: <AT realtime clock> port 0x70-0x77 irq 8 on acpi0
481Nov 29 08:46:52 	kernel 		Event timer "HPET4" frequency 14318180 Hz quality 440
482Nov 29 08:46:52 	kernel 		Event timer "HPET3" frequency 14318180 Hz quality 440
483Nov 29 08:46:52 	kernel 		Event timer "HPET2" frequency 14318180 Hz quality 440
484Nov 29 08:46:52 	kernel 		Event timer "HPET1" frequency 14318180 Hz quality 440
485Nov 29 08:46:52 	kernel 		Event timer "HPET" frequency 14318180 Hz quality 550
486Nov 29 08:46:52 	kernel 		Timecounter "HPET" frequency 14318180 Hz quality 950
487Nov 29 08:46:52 	kernel 		hpet0: <High Precision Event Timer> iomem 0xfed00000-0xfed003ff on acpi0
488Nov 29 08:46:52 	kernel 		cpu3: <ACPI CPU> on acpi0
489Nov 29 08:46:52 	kernel 		cpu2: <ACPI CPU> on acpi0
490Nov 29 08:46:52 	kernel 		cpu1: <ACPI CPU> on acpi0
491Nov 29 08:46:52 	kernel 		cpu0: <ACPI CPU> on acpi0
492Nov 29 08:46:52 	kernel 		acpi0: Power Button (fixed)
493Nov 29 08:46:52 	kernel 		acpi0: <ALASKA A M I > on motherboard
494Nov 29 08:46:52 	kernel 		padlock0: No ACE support.
495Nov 29 08:46:52 	kernel 		cryptosoft0: <software crypto> on motherboard
496Nov 29 08:46:52 	kernel 		nexus0
497Nov 29 08:46:52 	kernel 		random: fast provider: "Intel Secure Key RNG"
498Nov 29 08:46:52 	kernel 		random: registering fast source Intel Secure Key RNG
499Nov 29 08:46:52 	kernel 		module_register_init: MOD_LOAD (vesa, 0xffffffff81209800, 0) error 19
500Nov 29 08:46:52 	kernel 		netmap: loaded module
501Nov 29 08:46:52 	kernel 		kbd1 at kbdmux0
502Nov 29 08:46:52 	kernel 		hn: tranparent VF mode, if_transmit will be used, instead of if_start
503Nov 29 08:46:52 	kernel 		wlan: mac acl policy registered
504Nov 29 08:46:52 	kernel 		module_register_init: MOD_LOAD (iwi_monitor_fw, 0xffffffff806a75c0, 0) error 1
505Nov 29 08:46:52 	kernel 		iwi_monitor: If you agree with the license, set legal.intel_iwi.license_ack=1 in /boot/loader.conf.
506Nov 29 08:46:52 	kernel 		iwi_monitor: You need to read the LICENSE file in /usr/share/doc/legal/intel_iwi.LICENSE.
507Nov 29 08:46:52 	kernel 		module_register_init: MOD_LOAD (iwi_ibss_fw, 0xffffffff806a7510, 0) error 1
508Nov 29 08:46:52 	kernel 		iwi_ibss: If you agree with the license, set legal.intel_iwi.license_ack=1 in /boot/loader.conf.
509Nov 29 08:46:52 	kernel 		iwi_ibss: You need to read the LICENSE file in /usr/share/doc/legal/intel_iwi.LICENSE.
510Nov 29 08:46:52 	kernel 		module_register_init: MOD_LOAD (iwi_bss_fw, 0xffffffff806a7460, 0) error 1
511Nov 29 08:46:52 	kernel 		iwi_bss: If you agree with the license, set legal.intel_iwi.license_ack=1 in /boot/loader.conf.
512Nov 29 08:46:52 	kernel 		iwi_bss: You need to read the LICENSE file in /usr/share/doc/legal/intel_iwi.LICENSE.
513Nov 29 08:46:52 	kernel 		module_register_init: MOD_LOAD (ipw_monitor_fw, 0xffffffff80680590, 0) error 1
514Nov 29 08:46:52 	kernel 		ipw_monitor: If you agree with the license, set legal.intel_ipw.license_ack=1 in /boot/loader.conf.
515Nov 29 08:46:52 	kernel 		ipw_monitor: You need to read the LICENSE file in /usr/share/doc/legal/intel_ipw.LICENSE.
516Nov 29 08:46:52 	kernel 		module_register_init: MOD_LOAD (ipw_ibss_fw, 0xffffffff806804e0, 0) error 1
517Nov 29 08:46:52 	kernel 		ipw_ibss: If you agree with the license, set legal.intel_ipw.license_ack=1 in /boot/loader.conf.
518Nov 29 08:46:52 	kernel 		ipw_ibss: You need to read the LICENSE file in /usr/share/doc/legal/intel_ipw.LICENSE.
519Nov 29 08:46:52 	kernel 		random: entropy device external interface
520Nov 29 08:46:52 	kernel 		module_register_init: MOD_LOAD (ipw_bss_fw, 0xffffffff80680430, 0) error 1
521Nov 29 08:46:52 	kernel 		ipw_bss: If you agree with the license, set legal.intel_ipw.license_ack=1 in /boot/loader.conf.
522Nov 29 08:46:52 	kernel 		ipw_bss: You need to read the LICENSE file in /usr/share/doc/legal/intel_ipw.LICENSE.
523Nov 29 08:46:52 	kernel 		Timecounter "TSC" frequency 1596339538 Hz quality 1000
524Nov 29 08:46:52 	kernel 		SMP: AP CPU #3 Launched!
525Nov 29 08:46:52 	kernel 		SMP: AP CPU #2 Launched!
526Nov 29 08:46:52 	kernel 		SMP: AP CPU #1 Launched!
527Nov 29 08:46:52 	kernel 		ioapic0 <Version 2.0> irqs 0-39 on motherboard
528Nov 29 08:46:52 	kernel 		WARNING: Bogus Interrupt Trigger Mode. Assume CONFORMS.
529Nov 29 08:46:52 	kernel 		WARNING: Bogus Interrupt Trigger Mode. Assume CONFORMS.
530Nov 29 08:46:52 	kernel 		WARNING: Bogus Interrupt Polarity. Assume CONFORMS
531Nov 29 08:46:52 	kernel 		WARNING: Bogus Interrupt Trigger Mode. Assume CONFORMS.
532Nov 29 08:46:52 	kernel 		FreeBSD/SMP: 1 package(s) x 2 core(s) x 2 hardware threads
533Nov 29 08:46:52 	kernel 		FreeBSD/SMP: Multiprocessor System Detected: 4 CPUs
534Nov 29 08:46:52 	kernel 		ACPI APIC Table: <ALASKA A M I >
535Nov 29 08:46:52 	kernel 		Event timer "LAPIC" quality 600
536Nov 29 08:46:52 	kernel 		avail memory = 8166854656 (7788 MB)
537Nov 29 08:46:52 	kernel 		real memory = 8589934592 (8192 MB)
538Nov 29 08:46:52 	kernel 		TSC: P-state invariant, performance statistics
539Nov 29 08:46:52 	kernel 		VT-x: PAT,HLT,MTF,PAUSE,EPT,UG,VPID
540Nov 29 08:46:52 	kernel 		XSAVE Features=0x1<XSAVEOPT>
541Nov 29 08:46:52 	kernel 		Structured Extended Features=0x21c27ab<FSGSBASE,TSCADJ,BMI1,AVX2,SMEP,BMI2,ERMS,INVPCID,NFPUSG,RDSEED,ADX,SMAP,PROCTRACE>
542Nov 29 08:46:52 	kernel 		AMD Features2=0x121<LAHF,ABM,Prefetch>
543Nov 29 08:46:52 	kernel 		AMD Features=0x2c100800<SYSCALL,NX,Page1GB,RDTSCP,LM>
544Nov 29 08:46:52 	kernel 		Features2=0x7ffafbbf<SSE3,PCLMULQDQ,DTES64,MON,DS_CPL,VMX,EST,TM2,SSSE3,SDBG,FMA,CX16,xTPR,PDCM,PCID,SSE4.1,SSE4.2,x2APIC,MOVBE,POPCNT,TSCDLT,AESNI,XSAVE,OSXSAVE,AVX,F16C,RDRAND>
545Nov 29 08:46:52 	kernel 		Features=0xbfebfbff<FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,CLFLUSH,DTS,ACPI,MMX,FXSR,SSE,SSE2,SS,HTT,TM,PBE>
546Nov 29 08:46:52 	kernel 		Origin="GenuineIntel" Id=0x306d4 Family=0x6 Model=0x3d Stepping=4
547Nov 29 08:46:52 	kernel 		CPU: Intel(R) Core(TM) i5-5250U CPU @ 1.60GHz (1596.34-MHz K8-class CPU)
548Nov 29 08:46:52 	kernel 		VT(vga): resolution 640x480
549Nov 29 08:46:52 	kernel 		FreeBSD clang version 6.0.0 (tags/RELEASE_600/final 326565) (based on LLVM 6.0.0)
550Nov 29 08:46:52 	kernel 		root@buildbot3:/crossbuild/ce-244/obj/amd64/WvDslnYb/crossbuild/ce-244/pfSense/tmp/FreeBSD-src/sys/pfSense amd64
551Nov 29 08:46:52 	kernel 		FreeBSD 11.2-RELEASE-p3 #17 e6b497fa0a3(RELENG_2_4_4): Thu Sep 20 09:04:45 EDT 2018
552Nov 29 08:46:52 	kernel 		FreeBSD is a registered trademark of The FreeBSD Foundation.
553Nov 29 08:46:52 	kernel 		The Regents of the University of California. All rights reserved.
554Nov 29 08:46:52 	kernel 		Copyright (c) 1979, 1980, 1983, 1986, 1988, 1989, 1991, 1992, 1993, 1994
555Nov 29 08:46:52 	kernel 		Copyright (c) 1992-2018 The FreeBSD Project.
556Nov 29 08:46:52 	syslogd 		kernel boot file is /boot/kernel/kernel
557Nov 29 08:41:52 	syslogd 		exiting on signal 15
558Nov 29 08:41:46 	login 		login on ttyv0 as root
559Nov 29 08:41:45 	SnortStartup 	61489 	Snort START for WIFI snort protect (33777_igb2)...
560Nov 29 08:41:45 	barnyard2 	60968 	Waiting for new data
561Nov 29 08:41:45 	barnyard2 	60968 	Opened spool file '/var/log/snort/snort_igb117559/snort_17559_igb1.u2.1543509698'
562Nov 29 08:41:45 	barnyard2 	60968 	Closing spool file '/var/log/snort/snort_igb117559/snort_17559_igb1.u2.1543509508'. Read 0 records
563Nov 29 08:41:45 	barnyard2 	60968 	Opened spool file '/var/log/snort/snort_igb117559/snort_17559_igb1.u2.1543509508'
564Nov 29 08:41:45 	barnyard2 	60968 	Using waldo file '/var/log/snort/snort_igb117559/barnyard2/17559_igb1.waldo': spool directory = /var/log/snort/snort_igb117559 spool filebase = snort_17559_igb1.u2 time_stamp = 1543509508 record_idx = 0
565Nov 29 08:41:45 	barnyard2 	60968 	Barnyard2 initialization completed successfully (pid=60968)
566Nov 29 08:41:45 	barnyard2 	60968 	--== Initialization Complete ==--
567Nov 29 08:41:45 	barnyard2 	60968 	Writing PID "60968" to file "/var/run/barnyard2_igb117559.pid"
568Nov 29 08:41:45 	barnyard2 	60968 	PID path stat checked out ok, PID path set to /var/run
569Nov 29 08:41:45 	barnyard2 	60968 	Daemon initialized, signaled parent pid: 98195
570Nov 29 08:41:45 	barnyard2 	98195 	Daemon parent exiting
571Nov 29 08:41:45 	barnyard2 	98195 	Initializing daemon mode
572Nov 29 08:41:45 	barnyard2 	98195 	Configure syslog Priority : [LOG_INFO]
573Nov 29 08:41:45 	barnyard2 	98195 	Configure syslog Facility : [LOG_USER]
574Nov 29 08:41:45 	barnyard2 	98195 	Configured to log to local syslog
575Nov 29 08:41:45 	barnyard2 	98195 	Detail Level: Fast
576Nov 29 08:41:45 	barnyard2 	98195 	spo_syslog_full config:
577Nov 29 08:41:45 	barnyard2 	98195 	using operation_mode: default
578Nov 29 08:41:45 	barnyard2 	98195 	Local logging enabled, WILL NOT send information to a remote syslog
579Nov 29 08:41:45 	barnyard2 	98195 	Log directory = /var/log/snort/snort_igb117559
580Nov 29 08:41:45 	barnyard2 	98195 	Barnyard2 spooler: Event cache size set to [8192]
581Nov 29 08:41:45 	php_pfb 		[pfBlockerNG] filterlog daemon started
582Nov 29 08:41:45 	php_pfb 		[pfBlockerNG] filterlog daemon started
583Nov 29 08:41:45 	php 		[pfBlockerNG] DNSBL parser daemon started
584Nov 29 08:41:44 	barnyard2 	98195 	WARNING: Ignoring bad line in SID file: 'www.talosintelligence.com/reports/TALOS-2018-0721/'
585Nov 29 08:41:44 	barnyard2 	98195 	WARNING: invalid Reference spec 'url,'. Ignored
586Nov 29 08:41:44 	barnyard2 	98195 	WARNING: Ignoring bad line in SID file: 'www.talosintelligence.com/reports/TALOS-2018-0721/'
587Nov 29 08:41:44 	barnyard2 	98195 	WARNING: invalid Reference spec 'url,'. Ignored
588Nov 29 08:41:44 	php-fpm 	339 	[pfBlockerNG] Starting firewall filter daemon
589Nov 29 08:41:42 	barnyard2 	98195 	WARNING: Ignoring bad line in SID file: '/TALOS-2017-0350/ || url,www.talosintelligence.com/reports/TALOS-2017-0351/ || url,www.talosintelligence.com/reports/TALOS-2017-0380/'
590Nov 29 08:41:42 	barnyard2 	98195 	WARNING: Ignoring bad line in SID file: '/TALOS-2017-0350/ || url,www.talosintelligence.com/reports/TALOS-2017-0351/ || url,www.talosintelligence.com/reports/TALOS-2017-0380/'
591Nov 29 08:41:42 	barnyard2 	98195 	WARNING: Ignoring bad line in SID file: '/TALOS-2017-0350/ || url,www.talosintelligence.com/reports/TALOS-2017-0351/ || url,www.talosintelligence.com/reports/TALOS-2017-0380/'
592Nov 29 08:41:41 	ntopng 		[HTTPserver.cpp:923] ERROR: Unable to start HTTP server (IPv4) on ports 3000
593Nov 29 08:41:41 	ntopng 		[mongoose.c:4534] ERROR: set_ports_option: cannot bind to 3000: Address already in use
594Nov 29 08:41:41 	php 		[pfBlockerNG] DNSBL parser daemon started
595Nov 29 08:41:40 	barnyard2 	98195 	---------------------------- +[ Signature Suppress list ]+
596Nov 29 08:41:40 	barnyard2 	98195 	+[No entry in Signature Suppress List]+
597Nov 29 08:41:40 	barnyard2 	98195 	+[ Signature Suppress list ]+ ----------------------------
598Nov 29 08:41:40 	barnyard2 	98195 	Found pid path directive (/var/run)
599Nov 29 08:41:40 	barnyard2 	98195 	Parsing config file "/usr/local/etc/snort/snort_17559_igb1/barnyard2.conf"
600Nov 29 08:41:40 	barnyard2 	98195 	Initializing Output Plugins!
601Nov 29 08:41:40 	barnyard2 	98195 	Initializing Input Plugins!
602Nov 29 08:41:40 	barnyard2 	98195 	--== Initializing Barnyard2 ==--
603Nov 29 08:41:40 	barnyard2 	98195 	Running in Continuous mode
604Nov 29 08:41:40 	barnyard2 	98195 	Found pid path directive (/var/run)
605Nov 29 08:41:40 	SnortStartup 	97997 	Barnyard2 START for LAN snort protect (17559_igb1)...
606Nov 29 08:41:29 	SnortStartup 	96882 	Snort START for LAN snort protect (17559_igb1)...
607Nov 29 08:41:29 	barnyard2 	96662 	Waiting for new data
608Nov 29 08:41:29 	barnyard2 	96662 	Opened spool file '/var/log/snort/snort_igb015376/snort_15376_igb0.u2.1543509685'
609Nov 29 08:41:29 	barnyard2 	96662 	Closing spool file '/var/log/snort/snort_igb015376/snort_15376_igb0.u2.1543509495'. Read 0 records
610Nov 29 08:41:29 	barnyard2 	96662 	Opened spool file '/var/log/snort/snort_igb015376/snort_15376_igb0.u2.1543509495'
611Nov 29 08:41:29 	barnyard2 	96662 	Using waldo file '/var/log/snort/snort_igb015376/barnyard2/15376_igb0.waldo': spool directory = /var/log/snort/snort_igb015376 spool filebase = snort_15376_igb0.u2 time_stamp = 1543509495 record_idx = 0
612Nov 29 08:41:29 	barnyard2 	96662 	Barnyard2 initialization completed successfully (pid=96662)
613Nov 29 08:41:29 	barnyard2 	96662 	--== Initialization Complete ==--
614Nov 29 08:41:29 	barnyard2 	96662 	Writing PID "96662" to file "/var/run/barnyard2_igb015376.pid"
615Nov 29 08:41:29 	barnyard2 	96662 	PID path stat checked out ok, PID path set to /var/run
616Nov 29 08:41:29 	barnyard2 	96662 	Daemon initialized, signaled parent pid: 96471
617Nov 29 08:41:29 	barnyard2 	96471 	Daemon parent exiting
618Nov 29 08:41:29 	barnyard2 	96471 	Initializing daemon mode
619Nov 29 08:41:29 	barnyard2 	96471 	Configure syslog Priority : [LOG_INFO]
620Nov 29 08:41:29 	barnyard2 	96471 	Configure syslog Facility : [LOG_USER]
621Nov 29 08:41:29 	barnyard2 	96471 	Configured to log to local syslog
622Nov 29 08:41:29 	barnyard2 	96471 	Detail Level: Fast
623Nov 29 08:41:29 	barnyard2 	96471 	spo_syslog_full config:
624Nov 29 08:41:29 	barnyard2 	96471 	using operation_mode: default
625Nov 29 08:41:29 	barnyard2 	96471 	Local logging enabled, WILL NOT send information to a remote syslog
626Nov 29 08:41:29 	barnyard2 	96471 	Log directory = /var/log/snort/snort_igb015376
627Nov 29 08:41:29 	barnyard2 	96471 	Barnyard2 spooler: Event cache size set to [8192]
628Nov 29 08:41:27 	barnyard2 	96471 	---------------------------- +[ Signature Suppress list ]+
629Nov 29 08:41:27 	barnyard2 	96471 	+[No entry in Signature Suppress List]+
630Nov 29 08:41:27 	barnyard2 	96471 	+[ Signature Suppress list ]+ ----------------------------
631Nov 29 08:41:27 	barnyard2 	96471 	Found pid path directive (/var/run)
632Nov 29 08:41:27 	barnyard2 	96471 	Parsing config file "/usr/local/etc/snort/snort_15376_igb0/barnyard2.conf"
633Nov 29 08:41:27 	barnyard2 	96471 	Initializing Output Plugins!
634Nov 29 08:41:27 	barnyard2 	96471 	Initializing Input Plugins!
635Nov 29 08:41:27 	barnyard2 	96471 	--== Initializing Barnyard2 ==--
636Nov 29 08:41:27 	barnyard2 	96471 	Running in Continuous mode
637Nov 29 08:41:27 	barnyard2 	96471 	Found pid path directive (/var/run)
638Nov 29 08:41:27 	SnortStartup 	96203 	Barnyard2 START for WAN snort protect(15376_igb0)...
639Nov 29 08:41:21 	kernel 		igb0: promiscuous mode enabled
640Nov 29 08:41:21 	kernel 		igb2: promiscuous mode enabled
641Nov 29 08:41:21 	kernel 		igb1: promiscuous mode enabled
642Nov 29 08:41:19 	avahi-daemon 	79419 	Service "pfSense" (/usr/local/etc/avahi/services/sftp-ssh.service) successfully established.
643Nov 29 08:41:19 	avahi-daemon 	79419 	Service "pfSense" (/usr/local/etc/avahi/services/ssh.service) successfully established.
644Nov 29 08:41:18 	avahi-daemon 	79419 	Server startup complete. Host name is pfSense.local. Local service cookie is 3864035292.
645Nov 29 08:41:17 	avahi-daemon 	79379 	Failed to create PID file: File exists
646Nov 29 08:41:17 	avahi-daemon 	79379 	open(/var/run/avahi-daemon//pid): File exists
647Nov 29 08:41:17 	avahi-daemon 	79379 	Successfully dropped root privileges.
648Nov 29 08:41:17 	avahi-daemon 	79379 	Found user 'avahi' (UID 558) and group 'avahi' (GID 558).
649Nov 29 08:41:17 	avahi-daemon 	79419 	Registering HINFO record with values 'AMD64'/'FREEBSD'.
650Nov 29 08:41:17 	avahi-daemon 	79419 	Registering new address record for 192.168.90.1 on igb1.IPv4.
651Nov 29 08:41:17 	avahi-daemon 	79419 	Registering new address record for 10.10.10.1 on igb1.IPv4.
652Nov 29 08:41:17 	avahi-daemon 	79419 	Registering new address record for fe80::20e:c4ff:fed1:6f28 on igb1.*.
653Nov 29 08:41:17 	avahi-daemon 	79419 	Registering new address record for 192.168.70.1 on igb2.IPv4.
654Nov 29 08:41:17 	avahi-daemon 	79419 	Registering new address record for fe80::20e:c4ff:fed1:6f29 on igb2.*.
655Nov 29 08:41:17 	avahi-daemon 	79419 	Network interface enumeration completed.
656Nov 29 08:41:17 	avahi-daemon 	79419 	New relevant interface igb1.IPv4 for mDNS.
657Nov 29 08:41:17 	avahi-daemon 	79419 	Joining mDNS multicast group on interface igb1.IPv4 with address 10.10.10.1.
658Nov 29 08:41:17 	avahi-daemon 	79419 	New relevant interface igb2.IPv4 for mDNS.
659Nov 29 08:41:17 	avahi-daemon 	79419 	Joining mDNS multicast group on interface igb2.IPv4 with address 192.168.70.1.
660Nov 29 08:41:17 	avahi-daemon 	79419 	Loading service file /usr/local/etc/avahi/services/ssh.service.
661Nov 29 08:41:17 	avahi-daemon 	79419 	Loading service file /usr/local/etc/avahi/services/sftp-ssh.service.
662Nov 29 08:41:17 	avahi-daemon 	79419 	WARNING: No NSS support for mDNS detected, consider installing nss-mdns!
663Nov 29 08:41:17 	avahi-daemon 	79419 	avahi-daemon 0.7 starting up.
664Nov 29 08:41:17 	avahi-daemon 	79419 	Successfully dropped root privileges.
665Nov 29 08:41:17 	avahi-daemon 	79419 	Found user 'avahi' (UID 558) and group 'avahi' (GID 558).
666Nov 29 08:41:17 	php-fpm 	339 	/rc.start_packages: Starting service avahi
667Nov 29 08:41:17 	SnortStartup 	77009 	Snort START for WAN snort protect(15376_igb0)...
668Nov 29 08:41:17 	php-fpm 	339 	/rc.start_packages: Restarting/Starting all packages.
669Nov 29 08:41:17 	kernel 		done.
670Nov 29 08:41:17 	syslogd 		kernel boot file is /boot/kernel/kernel
671Nov 29 08:41:17 	syslogd 		exiting on signal 15
672Nov 29 08:41:15 	root 		/etc/rc.d/hostid: WARNING: hostid: unable to figure out a UUID from DMI data, generating a new one
673Nov 29 08:41:14 	kernel 		done.
674Nov 29 08:41:14 	php-cgi 		rc.bootup: Creating rrd update script
675Nov 29 08:41:10 	kernel 		.done.
676Nov 29 08:41:10 	php-fpm 	340 	/rc.dyndns.update: Dynamic DNS () There was an error trying to determine the public IP for interface - wan (igb0 ).
677Nov 29 08:41:09 	php-fpm 	340 	/rc.dyndns.update: Dynamic DNS (chudak.no-ip.org) There was an error trying to determine the public IP for interface - wan (igb0 ).
678Nov 29 08:41:08 	kernel 		..
679Nov 29 08:41:08 	kernel 		..
680Nov 29 08:41:08 	check_reload_status 		Updating all dyndns
681Nov 29 08:41:08 	dhcpleases 		kqueue error: unkown
682Nov 29 08:41:08 	kernel 		done.
683Nov 29 08:41:08 	kernel 		done.
684Nov 29 08:41:08 	php-cgi 		rc.bootup: NTPD is starting up.
685Nov 29 08:41:08 	kernel 		done.
686Nov 29 08:41:07 	kernel 		done.
687Nov 29 08:41:06 	kernel 		done.
688Nov 29 08:41:06 	php-cgi 		rc.bootup: sync unbound done.
689Nov 29 08:41:06 	kernel 		done.
690Nov 29 08:41:06 	php-cgi 		rc.bootup: Gateway, none 'available' for inet6, use the first one configured. ''
691Nov 29 08:41:06 	kernel 		.done.
692Nov 29 08:41:05 	php-fpm 	340 	/rc.newwanip: rc.newwanip: on (IP address: 192.168.2.1) (interface: []) (real interface: ovpns1).
693Nov 29 08:41:05 	php-fpm 	340 	/rc.newwanip: rc.newwanip: Info: starting on ovpns1.
694Nov 29 08:41:04 	kernel 		....
695Nov 29 08:41:04 	check_reload_status 		rc.newwanip starting ovpns1
696Nov 29 08:41:04 	kernel 		pflog0: promiscuous mode enabled
697Nov 29 08:41:04 	kernel 		ovpns1: link state changed to UP
698Nov 29 08:41:04 	kernel 		tun1: changing name to 'ovpns1'
699Nov 29 08:41:04 	kernel 		done.
700Nov 29 08:41:04 	php-cgi 		rc.bootup: Resyncing OpenVPN instances.
701Nov 29 08:41:04 	php-cgi 		rc.bootup: The command '/sbin/dhclient -c /var/etc/dhclient_wan.conf igb0 > /tmp/igb0_output 2> /tmp/igb0_error_output' returned exit code '1', the output was ''
702Nov 29 08:40:53 	syslogd 		Logging subprocess 9046 (exec /usr/local/sbin/sshguard) exited due to signal 15.
703Nov 29 08:40:53 	sshd 	8965 	Server listening on 0.0.0.0 port 22.
704Nov 29 08:40:53 	sshd 	8965 	Server listening on :: port 22.
705Nov 29 08:40:52 	kernel 		coretemp3: <CPU On-Die Thermal Sensors> on cpu3
706Nov 29 08:40:52 	kernel 		coretemp2: <CPU On-Die Thermal Sensors> on cpu2
707Nov 29 08:40:52 	kernel 		coretemp1: <CPU On-Die Thermal Sensors> on cpu1
708Nov 29 08:40:52 	kernel 		coretemp0: <CPU On-Die Thermal Sensors> on cpu0
709Nov 29 08:40:52 	kernel 		aesni0: <AES-CBC,AES-XTS,AES-GCM,AES-ICM> on motherboard
710Nov 29 08:40:52 	kernel 		padlock0: No ACE support.
711Nov 29 08:40:52 	kernel 		TSC: P-state invariant, performance statistics
712Nov 29 08:40:52 	kernel 		VT-x: PAT,HLT,MTF,PAUSE,EPT,UG,VPID
713Nov 29 08:40:52 	kernel 		XSAVE Features=0x1<XSAVEOPT>
714Nov 29 08:40:52 	kernel 		Structured Extended Features3=0x9c000000<IBPB,STIBP,SSBD>
715Nov 29 08:40:52 	kernel 		Structured Extended Features=0x21c27ab<FSGSBASE,TSCADJ,BMI1,AVX2,SMEP,BMI2,ERMS,INVPCID,NFPUSG,RDSEED,ADX,SMAP,PROCTRACE>
716Nov 29 08:40:52 	kernel 		AMD Features2=0x121<LAHF,ABM,Prefetch>
717Nov 29 08:40:52 	kernel 		AMD Features=0x2c100800<SYSCALL,NX,Page1GB,RDTSCP,LM>
718Nov 29 08:40:52 	kernel 		Features2=0x7ffafbbf<SSE3,PCLMULQDQ,DTES64,MON,DS_CPL,VMX,EST,TM2,SSSE3,SDBG,FMA,CX16,xTPR,PDCM,PCID,SSE4.1,SSE4.2,x2APIC,MOVBE,POPCNT,TSCDLT,AESNI,XSAVE,OSXSAVE,AVX,F16C,RDRAND>
719Nov 29 08:40:52 	kernel 		Features=0xbfebfbff<FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,CLFLUSH,DTS,ACPI,MMX,FXSR,SSE,SSE2,SS,HTT,TM,PBE>
720Nov 29 08:40:52 	kernel 		Origin="GenuineIntel" Id=0x306d4 Family=0x6 Model=0x3d Stepping=4
721Nov 29 08:40:52 	kernel 		CPU: Intel(R) Core(TM) i5-5250U CPU @ 1.60GHz (1596.34-MHz K8-class CPU)
722Nov 29 08:40:52 	kernel 		random: unblocking device.
723Nov 29 08:40:52 	kernel 		Trying to mount root from ufs:/dev/ufsid/593033af52fded36 [rw]...
724Nov 29 08:40:52 	kernel 		ada0: 28626MB (58626288 512 byte sectors)
725Nov 29 08:40:52 	kernel 		ada0: Command Queueing enabled
726Nov 29 08:40:52 	kernel 		ada0: 600.000MB/s transfers (SATA 3.x, UDMA6, PIO 8192bytes)
727Nov 29 08:40:52 	kernel 		ada0: Serial Number CVLI613001ZZ030H
728Nov 29 08:40:52 	kernel 		ada0: <INTEL SSDMCEAC030B3 LLLi> ACS-2 ATA SATA 3.x device
729Nov 29 08:40:52 	kernel 		ada0 at ahcich0 bus 0 scbus0 target 0 lun 0
730Nov 29 08:40:52 	kernel 		uhid0: <Apple Inc. Apple Keyboard, class 0/0, rev 2.00/0.74, addr 3> on usbus0
731Nov 29 08:40:52 	kernel 		uhid0 on uhub3
732Nov 29 08:40:52 	kernel 		kbd2 at ukbd0
733Nov 29 08:40:52 	kernel 		ukbd0: <Apple Inc. Apple Keyboard, class 0/0, rev 2.00/0.74, addr 3> on usbus0
734Nov 29 08:40:52 	kernel 		ukbd0 on uhub3
735Nov 29 08:40:52 	kernel 		ugen0.4: <Apple Inc. Apple Keyboard> at usbus0
736Nov 29 08:40:52 	kernel 		uhub3: 3 ports with 2 removable, bus powered
737Nov 29 08:40:52 	kernel 		uhub2: 8 ports with 8 removable, self powered
738Nov 29 08:40:52 	kernel 		uhub3: <Apple, Inc. Keyboard Hub, class 9/0, rev 2.00/96.15, addr 2> on usbus0
739Nov 29 08:40:52 	kernel 		uhub3 on uhub0
740Nov 29 08:40:52 	kernel 		ugen0.3: <Apple, Inc. Keyboard Hub> at usbus0
741Nov 29 08:40:52 	kernel 		uhub2: <vendor 0x8087 product 0x8001, class 9/0, rev 2.00/0.03, addr 2> on usbus1
742Nov 29 08:40:52 	kernel 		uhub2 on uhub1
743Nov 29 08:40:52 	kernel 		ugen1.2: <vendor 0x8087 product 0x8001> at usbus1
744Nov 29 08:40:52 	kernel 		ugen0.2: <Microsoft Microsoft 3-Button Mouse with IntelliEyeTM> at usbus0
745Nov 29 08:40:52 	kernel 		uhub1: 2 ports with 2 removable, self powered
746Nov 29 08:40:52 	kernel 		uhub0: 15 ports with 15 removable, self powered
747Nov 29 08:40:52 	kernel 		uhub1: <Intel EHCI root HUB, class 9/0, rev 2.00/1.00, addr 1> on usbus1
748Nov 29 08:40:52 	kernel 		uhub0: <0x8086 XHCI root HUB, class 9/0, rev 3.00/1.00, addr 1> on usbus0
749Nov 29 08:40:52 	kernel 		ugen1.1: <Intel EHCI root HUB> at usbus1
750Nov 29 08:40:52 	kernel 		ugen0.1: <0x8086 XHCI root HUB> at usbus0
751Nov 29 08:40:52 	kernel 		pcm1: <Realtek ALC662 (Analog 2.0+HP/2.0)> at nid 20,27 and 24,25 on hdaa1
752Nov 29 08:40:52 	kernel 		hdaa1: No presence detection support at nid 27
753Nov 29 08:40:52 	kernel 		hdaa1: <Realtek ALC662 Audio Function Group> at nid 1 on hdacc1
754Nov 29 08:40:52 	kernel 		hdacc1: <Realtek ALC662 HDA CODEC> at cad 0 on hdac1
755Nov 29 08:40:52 	kernel 		pcm0: <Intel Broadwell (HDMI/DP 8ch)> at nid 3 on hdaa0
756Nov 29 08:40:52 	kernel 		hdaa0: <Intel Broadwell Audio Function Group> at nid 1 on hdacc0
757Nov 29 08:40:52 	kernel 		hdacc0: <Intel Broadwell HDA CODEC> at cad 0 on hdac0
758Nov 29 08:40:52 	kernel 		Timecounters tick every 1.000 msec
759Nov 29 08:40:52 	kernel 		est3: <Enhanced SpeedStep Frequency Control> on cpu3
760Nov 29 08:40:52 	kernel 		est2: <Enhanced SpeedStep Frequency Control> on cpu2
761Nov 29 08:40:52 	kernel 		est1: <Enhanced SpeedStep Frequency Control> on cpu1
762Nov 29 08:40:52 	kernel 		est0: <Enhanced SpeedStep Frequency Control> on cpu0
763Nov 29 08:40:52 	kernel 		ppc0: cannot reserve I/O port range
764Nov 29 08:40:52 	kernel 		atkbd0: [GIANT-LOCKED]
765Nov 29 08:40:52 	kernel 		kbd0 at atkbd0
766Nov 29 08:40:52 	kernel 		atkbd0: <AT Keyboard> irq 1 on atkbdc0
767Nov 29 08:40:52 	kernel 		atkbdc0: <Keyboard controller (i8042)> at port 0x60,0x64 on isa0
768Nov 29 08:40:52 	kernel 		uart1: <16950 or compatible> port 0x2f8-0x2ff irq 3 on acpi0
769Nov 29 08:40:52 	kernel 		uart0: <16950 or compatible> port 0x3f8-0x3ff irq 4 flags 0x10 on acpi0
770Nov 29 08:40:52 	kernel 		acpi_tz1: <Thermal Zone> on acpi0
771Nov 29 08:40:52 	kernel 		acpi_tz0: <Thermal Zone> on acpi0
772Nov 29 08:40:52 	kernel 		acpi_button1: <Power Button> on acpi0
773Nov 29 08:40:52 	kernel 		acpi_button0: <Sleep Button> on acpi0
774Nov 29 08:40:52 	kernel 		ahcich0: <AHCI channel> at channel 0 on ahci0
775Nov 29 08:40:52 	kernel 		ahci0: AHCI v1.30 with 4 6Gbps ports, Port Multiplier not supported
776Nov 29 08:40:52 	kernel 		ahci0: <AHCI SATA controller> port 0xf0b0-0xf0b7,0xf0a0-0xf0a3,0xf090-0xf097,0xf080-0xf083,0xf060-0xf07f mem 0xf7419000-0xf74197ff irq 19 at device 31.2 on pci0
777Nov 29 08:40:52 	kernel 		isa0: <ISA bus> on isab0
778Nov 29 08:40:52 	kernel 		isab0: <PCI-ISA bridge> at device 31.0 on pci0
779Nov 29 08:40:52 	kernel 		usbus1: 480Mbps High Speed USB v2.0
780Nov 29 08:40:52 	kernel 		usbus1 on ehci0
781Nov 29 08:40:52 	kernel 		usbus1: EHCI version 1.0
782Nov 29 08:40:52 	kernel 		ehci0: <EHCI (generic) USB 2.0 controller> mem 0xf741a000-0xf741a3ff irq 23 at device 29.0 on pci0
783Nov 29 08:40:52 	kernel 		igb3: netmap queues/slots: TX 2/1024, RX 2/1024
784Nov 29 08:40:52 	kernel 		igb3: Bound queue 1 to cpu 3
785Nov 29 08:40:52 	kernel 		igb3: Bound queue 0 to cpu 2
786Nov 29 08:40:52 	kernel 		igb3: Ethernet address: 00:0e:c4:d1:6f:2a
787Nov 29 08:40:52 	kernel 		igb3: Using MSIX interrupts with 3 vectors
788Nov 29 08:40:52 	kernel 		igb3: <Intel(R) PRO/1000 Network Connection, Version - 2.5.3-k> port 0xb000-0xb01f mem 0xf7000000-0xf701ffff,0xf7020000-0xf7023fff irq 16 at device 0.0 on pci4
789Nov 29 08:40:52 	kernel 		pci4: <ACPI PCI bus> on pcib4
790Nov 29 08:40:52 	kernel 		pcib4: <ACPI PCI-PCI bridge> irq 16 at device 28.4 on pci0
791Nov 29 08:40:52 	kernel 		igb2: netmap queues/slots: TX 2/1024, RX 2/1024
792Nov 29 08:40:52 	kernel 		igb2: Bound queue 1 to cpu 1
793Nov 29 08:40:52 	kernel 		igb2: Bound queue 0 to cpu 0
794Nov 29 08:40:52 	kernel 		igb2: Ethernet address: 00:0e:c4:d1:6f:29
795Nov 29 08:40:52 	kernel 		igb2: Using MSIX interrupts with 3 vectors
796Nov 29 08:40:52 	kernel 		igb2: <Intel(R) PRO/1000 Network Connection, Version - 2.5.3-k> port 0xc000-0xc01f mem 0xf7100000-0xf711ffff,0xf7120000-0xf7123fff irq 18 at device 0.0 on pci3
797Nov 29 08:40:52 	kernel 		pci3: <ACPI PCI bus> on pcib3
798Nov 29 08:40:52 	kernel 		pcib3: <ACPI PCI-PCI bridge> irq 18 at device 28.2 on pci0
799Nov 29 08:40:52 	kernel 		igb1: netmap queues/slots: TX 2/1024, RX 2/1024
800Nov 29 08:40:52 	kernel 		igb1: Bound queue 1 to cpu 3
801Nov 29 08:40:52 	kernel 		igb1: Bound queue 0 to cpu 2
802Nov 29 08:40:52 	kernel 		igb1: Ethernet address: 00:0e:c4:d1:6f:28
803Nov 29 08:40:52 	kernel 		igb1: Using MSIX interrupts with 3 vectors
804Nov 29 08:40:52 	kernel 		igb1: <Intel(R) PRO/1000 Network Connection, Version - 2.5.3-k> port 0xd000-0xd01f mem 0xf7200000-0xf721ffff,0xf7220000-0xf7223fff irq 17 at device 0.0 on pci2
805Nov 29 08:40:52 	kernel 		pci2: <ACPI PCI bus> on pcib2
806Nov 29 08:40:52 	kernel 		pcib2: <ACPI PCI-PCI bridge> irq 17 at device 28.1 on pci0
807Nov 29 08:40:52 	kernel 		igb0: netmap queues/slots: TX 2/1024, RX 2/1024
808Nov 29 08:40:52 	kernel 		igb0: Bound queue 1 to cpu 1
809Nov 29 08:40:52 	kernel 		igb0: Bound queue 0 to cpu 0
810Nov 29 08:40:52 	kernel 		igb0: Ethernet address: 00:0e:c4:d1:6f:27
811Nov 29 08:40:52 	kernel 		igb0: Using MSIX interrupts with 3 vectors
812Nov 29 08:40:52 	kernel 		igb0: <Intel(R) PRO/1000 Network Connection, Version - 2.5.3-k> port 0xe000-0xe01f mem 0xf7300000-0xf731ffff,0xf7320000-0xf7323fff irq 16 at device 0.0 on pci1
813Nov 29 08:40:52 	kernel 		pci1: <ACPI PCI bus> on pcib1
814Nov 29 08:40:52 	kernel 		pcib1: <ACPI PCI-PCI bridge> irq 16 at device 28.0 on pci0
815Nov 29 08:40:52 	kernel 		hdac1: <Intel Broadwell HDA Controller> mem 0xf7410000-0xf7413fff irq 22 at device 27.0 on pci0
816Nov 29 08:40:52 	kernel 		pci0: <simple comms> at device 22.0 (no driver attached)
817Nov 29 08:40:52 	kernel 		usbus0: 5.0Gbps Super Speed USB v3.0
818Nov 29 08:40:52 	kernel 		usbus0 on xhci0
819Nov 29 08:40:52 	kernel 		xhci0: Port routing mask set to 0xffffffff
820Nov 29 08:40:52 	kernel 		xhci0: 32 bytes context size, 64-bit DMA
821Nov 29 08:40:52 	kernel 		xhci0: <Broadwell Integrated PCH-LP chipset USB 3.0 controller> mem 0xf7400000-0xf740ffff irq 21 at device 20.0 on pci0
822Nov 29 08:40:52 	kernel 		hdac0: <Intel Broadwell HDA Controller> mem 0xf7414000-0xf7417fff irq 16 at device 3.0 on pci0
823Nov 29 08:40:52 	kernel 		vgapci0: Boot video device
824Nov 29 08:40:52 	kernel 		vgapci0: <VGA-compatible display> port 0xf000-0xf03f mem 0xf6000000-0xf6ffffff,0xe0000000-0xefffffff irq 16 at device 2.0 on pci0
825Nov 29 08:40:52 	kernel 		pci0: <ACPI PCI bus> on pcib0
826Nov 29 08:40:52 	kernel 		pcib0: <ACPI Host-PCI bridge> port 0xcf8-0xcff on acpi0
827Nov 29 08:40:52 	kernel 		acpi_timer0: <24-bit timer at 3.579545MHz> port 0x1808-0x180b on acpi0
828Nov 29 08:40:52 	kernel 		Timecounter "ACPI-fast" frequency 3579545 Hz quality 900
829Nov 29 08:40:52 	kernel 		Event timer "i8254" frequency 1193182 Hz quality 100
830Nov 29 08:40:52 	kernel 		Timecounter "i8254" frequency 1193182 Hz quality 0
831Nov 29 08:40:52 	kernel 		attimer0: <AT timer> port 0x40-0x43,0x50-0x53 irq 0 on acpi0
832Nov 29 08:40:52 	kernel 		Event timer "RTC" frequency 32768 Hz quality 0
833Nov 29 08:40:52 	kernel 		atrtc0: registered as a time-of-day clock, resolution 1.000000s
834Nov 29 08:40:52 	kernel 		atrtc0: Warning: Couldn't map I/O.
835Nov 29 08:40:52 	kernel 		atrtc0: <AT realtime clock> port 0x70-0x77 irq 8 on acpi0
836Nov 29 08:40:52 	kernel 		Event timer "HPET4" frequency 14318180 Hz quality 440
837Nov 29 08:40:52 	kernel 		Event timer "HPET3" frequency 14318180 Hz quality 440
838Nov 29 08:40:52 	kernel 		Event timer "HPET2" frequency 14318180 Hz quality 440
839Nov 29 08:40:52 	kernel 		Event timer "HPET1" frequency 14318180 Hz quality 440
840Nov 29 08:40:52 	kernel 		Event timer "HPET" frequency 14318180 Hz quality 550
841Nov 29 08:40:52 	kernel 		Timecounter "HPET" frequency 14318180 Hz quality 950
842Nov 29 08:40:52 	kernel 		hpet0: <High Precision Event Timer> iomem 0xfed00000-0xfed003ff on acpi0
843Nov 29 08:40:52 	kernel 		cpu3: <ACPI CPU> on acpi0
844Nov 29 08:40:52 	kernel 		cpu2: <ACPI CPU> on acpi0
845Nov 29 08:40:52 	kernel 		cpu1: <ACPI CPU> on acpi0
846Nov 29 08:40:52 	kernel 		cpu0: <ACPI CPU> on acpi0
847Nov 29 08:40:52 	kernel 		acpi0: Power Button (fixed)
848Nov 29 08:40:52 	kernel 		acpi0: <ALASKA A M I > on motherboard
849Nov 29 08:40:52 	kernel 		padlock0: No ACE support.
850Nov 29 08:40:52 	kernel 		cryptosoft0: <software crypto> on motherboard
851Nov 29 08:40:52 	kernel 		vtvga0: <VT VGA driver> on motherboard
852Nov 29 08:40:52 	kernel 		nexus0
853Nov 29 08:40:52 	kernel 		random: fast provider: "Intel Secure Key RNG"
854Nov 29 08:40:52 	kernel 		random: registering fast source Intel Secure Key RNG
855Nov 29 08:40:52 	kernel 		module_register_init: MOD_LOAD (vesa, 0xffffffff81209800, 0) error 19
856Nov 29 08:40:52 	kernel 		netmap: loaded module
857Nov 29 08:40:52 	kernel 		kbd1 at kbdmux0
858Nov 29 08:40:52 	kernel 		hn: tranparent VF mode, if_transmit will be used, instead of if_start
859Nov 29 08:40:52 	kernel 		wlan: mac acl policy registered
860Nov 29 08:40:52 	kernel 		module_register_init: MOD_LOAD (iwi_monitor_fw, 0xffffffff806a75c0, 0) error 1
861Nov 29 08:40:52 	kernel 		iwi_monitor: If you agree with the license, set legal.intel_iwi.license_ack=1 in /boot/loader.conf.
862Nov 29 08:40:52 	kernel 		iwi_monitor: You need to read the LICENSE file in /usr/share/doc/legal/intel_iwi.LICENSE.
863Nov 29 08:40:52 	kernel 		module_register_init: MOD_LOAD (iwi_ibss_fw, 0xffffffff806a7510, 0) error 1
864Nov 29 08:40:52 	kernel 		iwi_ibss: If you agree with the license, set legal.intel_iwi.license_ack=1 in /boot/loader.conf.
865Nov 29 08:40:52 	kernel 		iwi_ibss: You need to read the LICENSE file in /usr/share/doc/legal/intel_iwi.LICENSE.
866Nov 29 08:40:52 	kernel 		module_register_init: MOD_LOAD (iwi_bss_fw, 0xffffffff806a7460, 0) error 1
867Nov 29 08:40:52 	kernel 		iwi_bss: If you agree with the license, set legal.intel_iwi.license_ack=1 in /boot/loader.conf.
868Nov 29 08:40:52 	kernel 		iwi_bss: You need to read the LICENSE file in /usr/share/doc/legal/intel_iwi.LICENSE.
869Nov 29 08:40:52 	kernel 		module_register_init: MOD_LOAD (ipw_monitor_fw, 0xffffffff80680590, 0) error 1
870Nov 29 08:40:52 	kernel 		ipw_monitor: If you agree with the license, set legal.intel_ipw.license_ack=1 in /boot/loader.conf.
871Nov 29 08:40:52 	kernel 		ipw_monitor: You need to read the LICENSE file in /usr/share/doc/legal/intel_ipw.LICENSE.
872Nov 29 08:40:52 	kernel 		module_register_init: MOD_LOAD (ipw_ibss_fw, 0xffffffff806804e0, 0) error 1
873Nov 29 08:40:52 	kernel 		ipw_ibss: If you agree with the license, set legal.intel_ipw.license_ack=1 in /boot/loader.conf.
874Nov 29 08:40:52 	kernel 		ipw_ibss: You need to read the LICENSE file in /usr/share/doc/legal/intel_ipw.LICENSE.
875Nov 29 08:40:52 	kernel 		random: entropy device external interface
876Nov 29 08:40:52 	kernel 		module_register_init: MOD_LOAD (ipw_bss_fw, 0xffffffff80680430, 0) error 1
877Nov 29 08:40:52 	kernel 		ipw_bss: If you agree with the license, set legal.intel_ipw.license_ack=1 in /boot/loader.conf.
878Nov 29 08:40:52 	kernel 		ipw_bss: You need to read the LICENSE file in /usr/share/doc/legal/intel_ipw.LICENSE.
879Nov 29 08:40:52 	kernel 		Timecounter "TSC" frequency 1596342560 Hz quality 1000
880Nov 29 08:40:52 	kernel 		SMP: AP CPU #2 Launched!
881Nov 29 08:40:52 	kernel 		SMP: AP CPU #3 Launched!
882Nov 29 08:40:52 	kernel 		SMP: AP CPU #1 Launched!
883Nov 29 08:40:52 	kernel 		ioapic0 <Version 2.0> irqs 0-39 on motherboard
884Nov 29 08:40:52 	kernel 		WARNING: Bogus Interrupt Trigger Mode. Assume CONFORMS.
885Nov 29 08:40:52 	kernel 		WARNING: Bogus Interrupt Trigger Mode. Assume CONFORMS.
886Nov 29 08:40:52 	kernel 		WARNING: Bogus Interrupt Polarity. Assume CONFORMS
887Nov 29 08:40:52 	kernel 		WARNING: Bogus Interrupt Trigger Mode. Assume CONFORMS.
888Nov 29 08:40:52 	kernel 		FreeBSD/SMP: 1 package(s) x 2 core(s) x 2 hardware threads
889Nov 29 08:40:52 	kernel 		FreeBSD/SMP: Multiprocessor System Detected: 4 CPUs
890Nov 29 08:40:52 	kernel 		ACPI APIC Table: <ALASKA A M I >
891Nov 29 08:40:52 	kernel 		Event timer "LAPIC" quality 600
892Nov 29 08:40:52 	kernel 		avail memory = 8166854656 (7788 MB)
893Nov 29 08:40:52 	kernel 		real memory = 8589934592 (8192 MB)
894Nov 29 08:40:52 	kernel 		TSC: P-state invariant, performance statistics
895Nov 29 08:40:52 	kernel 		VT-x: PAT,HLT,MTF,PAUSE,EPT,UG,VPID
896Nov 29 08:40:52 	kernel 		XSAVE Features=0x1<XSAVEOPT>
897Nov 29 08:40:52 	kernel 		Structured Extended Features=0x21c27ab<FSGSBASE,TSCADJ,BMI1,AVX2,SMEP,BMI2,ERMS,INVPCID,NFPUSG,RDSEED,ADX,SMAP,PROCTRACE>
898Nov 29 08:40:52 	kernel 		AMD Features2=0x121<LAHF,ABM,Prefetch>
899Nov 29 08:40:52 	kernel 		AMD Features=0x2c100800<SYSCALL,NX,Page1GB,RDTSCP,LM>
900Nov 29 08:40:52 	kernel 		Features2=0x7ffafbbf<SSE3,PCLMULQDQ,DTES64,MON,DS_CPL,VMX,EST,TM2,SSSE3,SDBG,FMA,CX16,xTPR,PDCM,PCID,SSE4.1,SSE4.2,x2APIC,MOVBE,POPCNT,TSCDLT,AESNI,XSAVE,OSXSAVE,AVX,F16C,RDRAND>
901Nov 29 08:40:52 	kernel 		Features=0xbfebfbff<FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,CLFLUSH,DTS,ACPI,MMX,FXSR,SSE,SSE2,SS,HTT,TM,PBE>
902Nov 29 08:40:52 	kernel 		Origin="GenuineIntel" Id=0x306d4 Family=0x6 Model=0x3d Stepping=4
903Nov 29 08:40:52 	kernel 		CPU: Intel(R) Core(TM) i5-5250U CPU @ 1.60GHz (1596.34-MHz K8-class CPU)
904Nov 29 08:40:52 	kernel 		VT(vga): resolution 640x480
905Nov 29 08:40:52 	kernel 		FreeBSD clang version 6.0.0 (tags/RELEASE_600/final 326565) (based on LLVM 6.0.0)
906Nov 29 08:40:52 	kernel 		root@buildbot3:/crossbuild/ce-244/obj/amd64/WvDslnYb/crossbuild/ce-244/pfSense/tmp/FreeBSD-src/sys/pfSense amd64
907Nov 29 08:40:52 	kernel 		FreeBSD 11.2-RELEASE-p3 #17 e6b497fa0a3(RELENG_2_4_4): Thu Sep 20 09:04:45 EDT 2018
908Nov 29 08:40:52 	kernel 		FreeBSD is a registered trademark of The FreeBSD Foundation.
909Nov 29 08:40:52 	kernel 		The Regents of the University of California. All rights reserved.
910Nov 29 08:40:52 	kernel 		Copyright (c) 1979, 1980, 1983, 1986, 1988, 1989, 1991, 1992, 1993, 1994
911Nov 29 08:40:52 	kernel 		Copyright (c) 1992-2018 The FreeBSD Project.
912Nov 29 08:40:52 	syslogd 		kernel boot file is /boot/kernel/kernel
913Nov 29 08:39:42 	syslogd 		exiting on signal 15
914Nov 29 08:39:42 	barnyard2 	74662 	*** Caught Term-Signal
915Nov 29 08:39:42 	syslogd 		Logging subprocess 66454 (exec /usr/local/sbin/sshguard) exited due to signal 15.
916Nov 29 08:39:41 	shutdown 		power-down by root:
917Nov 29 08:39:41 	sudo 		root : TTY=ttyv0 ; PWD=/root ; USER=root ; COMMAND=/sbin/poweroff
918Nov 29 08:39:30 	sudo 		root : TTY=ttyv0 ; PWD=/root ; USER=root ; COMMAND=/sbin/shutdown
919Nov 29 08:38:51 	barnyard2 	74662 	Waiting for new data
920Nov 29 08:38:51 	barnyard2 	74662 	Opened spool file '/var/log/snort/snort_igb233777/snort_33777_igb2.u2.1543509525'
921Nov 29 08:38:51 	barnyard2 	74662 	Closing spool file '/var/log/snort/snort_igb233777/snort_33777_igb2.u2.1543457156'. Read 0 records
922Nov 29 08:38:51 	barnyard2 	74662 	Opened spool file '/var/log/snort/snort_igb233777/snort_33777_igb2.u2.1543457156'
923Nov 29 08:38:51 	barnyard2 	74662 	Using waldo file '/var/log/snort/snort_igb233777/barnyard2/33777_igb2.waldo': spool directory = /var/log/snort/snort_igb233777 spool filebase = snort_33777_igb2.u2 time_stamp = 1543457156 record_idx = 0
924Nov 29 08:38:51 	barnyard2 	74662 	Barnyard2 initialization completed successfully (pid=74662)
925Nov 29 08:38:51 	barnyard2 	74662 	--== Initialization Complete ==--
926Nov 29 08:38:51 	barnyard2 	74662 	Writing PID "74662" to file "/var/run/barnyard2_igb233777.pid"
927Nov 29 08:38:51 	barnyard2 	74662 	PID path stat checked out ok, PID path set to /var/run
928Nov 29 08:38:51 	barnyard2 	74662 	Daemon initialized, signaled parent pid: 74462
929Nov 29 08:38:51 	barnyard2 	74462 	Daemon parent exiting
930Nov 29 08:38:51 	barnyard2 	74462 	Initializing daemon mode
931Nov 29 08:38:51 	barnyard2 	74462 	Configure syslog Priority : [LOG_INFO]
932Nov 29 08:38:51 	barnyard2 	74462 	Configure syslog Facility : [LOG_USER]
933Nov 29 08:38:51 	barnyard2 	74462 	Configured to log to local syslog
934Nov 29 08:38:51 	barnyard2 	74462 	Detail Level: Fast
935Nov 29 08:38:51 	barnyard2 	74462 	spo_syslog_full config:
936Nov 29 08:38:51 	barnyard2 	74462 	using operation_mode: default
937Nov 29 08:38:51 	barnyard2 	74462 	Local logging enabled, WILL NOT send information to a remote syslog
938Nov 29 08:38:51 	barnyard2 	74462 	Log directory = /var/log/snort/snort_igb233777
939Nov 29 08:38:51 	barnyard2 	74462 	Barnyard2 spooler: Event cache size set to [8192]
940Nov 29 08:38:50 	barnyard2 	74462 	WARNING: Ignoring bad line in SID file: 'www.talosintelligence.com/reports/TALOS-2018-0721/'
941Nov 29 08:38:50 	barnyard2 	74462 	WARNING: invalid Reference spec 'url,'. Ignored
942Nov 29 08:38:50 	barnyard2 	74462 	WARNING: Ignoring bad line in SID file: 'www.talosintelligence.com/reports/TALOS-2018-0721/'
943Nov 29 08:38:50 	barnyard2 	74462 	WARNING: invalid Reference spec 'url,'. Ignored
944Nov 29 08:38:48 	barnyard2 	74462 	WARNING: Ignoring bad line in SID file: '/TALOS-2017-0350/ || url,www.talosintelligence.com/reports/TALOS-2017-0351/ || url,www.talosintelligence.com/reports/TALOS-2017-0380/'
945Nov 29 08:38:48 	barnyard2 	74462 	WARNING: Ignoring bad line in SID file: '/TALOS-2017-0350/ || url,www.talosintelligence.com/reports/TALOS-2017-0351/ || url,www.talosintelligence.com/reports/TALOS-2017-0380/'
946Nov 29 08:38:48 	barnyard2 	74462 	WARNING: Ignoring bad line in SID file: '/TALOS-2017-0350/ || url,www.talosintelligence.com/reports/TALOS-2017-0351/ || url,www.talosintelligence.com/reports/TALOS-2017-0380/'
947Nov 29 08:38:47 	barnyard2 	74462 	---------------------------- +[ Signature Suppress list ]+
948Nov 29 08:38:47 	barnyard2 	74462 	+[No entry in Signature Suppress List]+
949Nov 29 08:38:47 	barnyard2 	74462 	+[ Signature Suppress list ]+ ----------------------------
950Nov 29 08:38:47 	barnyard2 	74462 	Found pid path directive (/var/run)
951Nov 29 08:38:47 	barnyard2 	74462 	Parsing config file "/usr/local/etc/snort/snort_33777_igb2/barnyard2.conf"
952Nov 29 08:38:47 	barnyard2 	74462 	Initializing Output Plugins!
953Nov 29 08:38:47 	barnyard2 	74462 	Initializing Input Plugins!
954Nov 29 08:38:47 	barnyard2 	74462 	--== Initializing Barnyard2 ==--
955Nov 29 08:38:47 	barnyard2 	74462 	Running in Continuous mode
956Nov 29 08:38:47 	barnyard2 	74462 	Found pid path directive (/var/run)
957Nov 29 08:38:47 	SnortStartup 	74271 	Barnyard2 START for WIFI snort protect (33777_igb2)...
958Nov 29 08:38:37 	login 		login on ttyv0 as root
959Nov 29 08:38:36 	php 		[pfBlockerNG] DNSBL parser daemon started
960Nov 29 08:38:35 	php_pfb 		[pfBlockerNG] filterlog daemon started
961Nov 29 08:38:35 	php_pfb 		[pfBlockerNG] filterlog daemon started
962Nov 29 08:38:35 	php-fpm 	339 	[pfBlockerNG] Restarting firewall filter daemon
963Nov 29 08:38:35 	check_reload_status 		Reloading filter
964Nov 29 08:38:35 	SnortStartup 	24246 	Snort START for WIFI snort protect (33777_igb2)...
965Nov 29 08:38:35 	barnyard2 	24217 	Waiting for new data
966Nov 29 08:38:35 	barnyard2 	24217 	Opened spool file '/var/log/snort/snort_igb117559/snort_17559_igb1.u2.1543509508'
967Nov 29 08:38:35 	barnyard2 	24217 	Closing spool file '/var/log/snort/snort_igb117559/snort_17559_igb1.u2.1543457154'. Read 0 records
968Nov 29 08:38:35 	barnyard2 	24217 	Opened spool file '/var/log/snort/snort_igb117559/snort_17559_igb1.u2.1543457154'
969Nov 29 08:38:35 	barnyard2 	24217 	Using waldo file '/var/log/snort/snort_igb117559/barnyard2/17559_igb1.waldo': spool directory = /var/log/snort/snort_igb117559 spool filebase = snort_17559_igb1.u2 time_stamp = 1543457154 record_idx = 0
970Nov 29 08:38:35 	barnyard2 	24217 	Barnyard2 initialization completed successfully (pid=24217)
971Nov 29 08:38:35 	barnyard2 	24217 	--== Initialization Complete ==--
972Nov 29 08:38:35 	barnyard2 	24217 	Writing PID "24217" to file "/var/run/barnyard2_igb117559.pid"
973Nov 29 08:38:35 	barnyard2 	24217 	PID path stat checked out ok, PID path set to /var/run
974Nov 29 08:38:35 	barnyard2 	24217 	Daemon initialized, signaled parent pid: 91592
975Nov 29 08:38:35 	barnyard2 	91592 	Daemon parent exiting
976Nov 29 08:38:35 	barnyard2 	91592 	Initializing daemon mode
977Nov 29 08:38:35 	barnyard2 	91592 	Configure syslog Priority : [LOG_INFO]
978Nov 29 08:38:35 	barnyard2 	91592 	Configure syslog Facility : [LOG_USER]
979Nov 29 08:38:35 	barnyard2 	91592 	Configured to log to local syslog
980Nov 29 08:38:35 	barnyard2 	91592 	Detail Level: Fast
981Nov 29 08:38:35 	barnyard2 	91592 	spo_syslog_full config:
982Nov 29 08:38:35 	barnyard2 	91592 	using operation_mode: default
983Nov 29 08:38:35 	barnyard2 	91592 	Local logging enabled, WILL NOT send information to a remote syslog
984Nov 29 08:38:35 	barnyard2 	91592 	Log directory = /var/log/snort/snort_igb117559
985Nov 29 08:38:35 	barnyard2 	91592 	Barnyard2 spooler: Event cache size set to [8192]
986Nov 29 08:38:35 	php-fpm 	339 	/rc.start_packages: End of configuration backup to https://acb.netgate.com/save (success).
987Nov 29 08:38:35 	barnyard2 	91592 	WARNING: Ignoring bad line in SID file: 'www.talosintelligence.com/reports/TALOS-2018-0721/'
988Nov 29 08:38:35 	barnyard2 	91592 	WARNING: invalid Reference spec 'url,'. Ignored
989Nov 29 08:38:35 	barnyard2 	91592 	WARNING: Ignoring bad line in SID file: 'www.talosintelligence.com/reports/TALOS-2018-0721/'
990Nov 29 08:38:35 	barnyard2 	91592 	WARNING: invalid Reference spec 'url,'. Ignored
991Nov 29 08:38:35 	php-fpm 	339 	/rc.start_packages: Beginning configuration backup to .https://acb.netgate.com/save
992Nov 29 08:38:35 	check_reload_status 		Syncing firewall
993Nov 29 08:38:32 	barnyard2 	91592 	WARNING: Ignoring bad line in SID file: '/TALOS-2017-0350/ || url,www.talosintelligence.com/reports/TALOS-2017-0351/ || url,www.talosintelligence.com/reports/TALOS-2017-0380/'
994Nov 29 08:38:32 	barnyard2 	91592 	WARNING: Ignoring bad line in SID file: '/TALOS-2017-0350/ || url,www.talosintelligence.com/reports/TALOS-2017-0351/ || url,www.talosintelligence.com/reports/TALOS-2017-0380/'
995Nov 29 08:38:32 	barnyard2 	91592 	WARNING: Ignoring bad line in SID file: '/TALOS-2017-0350/ || url,www.talosintelligence.com/reports/TALOS-2017-0351/ || url,www.talosintelligence.com/reports/TALOS-2017-0380/'
996Nov 29 08:38:31 	ntopng 		[HTTPserver.cpp:923] ERROR: Unable to start HTTP server (IPv4) on ports 3000
997Nov 29 08:38:31 	ntopng 		[mongoose.c:4534] ERROR: set_ports_option: cannot bind to 3000: Address already in use
998Nov 29 08:38:31 	php 		[pfBlockerNG] DNSBL parser daemon started
999Nov 29 08:38:30 	barnyard2 	91592 	---------------------------- +[ Signature Suppress list ]+
1000Nov 29 08:38:30 	barnyard2 	91592 	+[No entry in Signature Suppress List]+
1001Nov 29 08:38:30 	barnyard2 	91592 	+[ Signature Suppress list ]+ ----------------------------
1002Nov 29 08:38:30 	barnyard2 	91592 	Found pid path directive (/var/run)
1003Nov 29 08:38:30 	barnyard2 	91592 	Parsing config file "/usr/local/etc/snort/snort_17559_igb1/barnyard2.conf"
1004Nov 29 08:38:30 	barnyard2 	91592 	Initializing Output Plugins!
1005Nov 29 08:38:30 	barnyard2 	91592 	Initializing Input Plugins!
1006Nov 29 08:38:30 	barnyard2 	91592 	--== Initializing Barnyard2 ==--
1007Nov 29 08:38:30 	barnyard2 	91592 	Running in Continuous mode
1008Nov 29 08:38:30 	barnyard2 	91592 	Found pid path directive (/var/run)
1009Nov 29 08:38:30 	SnortStartup 	91317 	Barnyard2 START for LAN snort protect (17559_igb1)...
1010Nov 29 08:38:19 	SnortStartup 	90034 	Snort START for LAN snort protect (17559_igb1)...
1011Nov 29 08:38:19 	barnyard2 	89958 	Waiting for new data
1012Nov 29 08:38:19 	barnyard2 	89958 	Opened spool file '/var/log/snort/snort_igb015376/snort_15376_igb0.u2.1543509495'
1013Nov 29 08:38:19 	barnyard2 	89958 	Closing spool file '/var/log/snort/snort_igb015376/snort_15376_igb0.u2.1543457151'. Read 0 records
1014Nov 29 08:38:19 	barnyard2 	89958 	Opened spool file '/var/log/snort/snort_igb015376/snort_15376_igb0.u2.1543457151'
1015Nov 29 08:38:19 	barnyard2 	89958 	Using waldo file '/var/log/snort/snort_igb015376/barnyard2/15376_igb0.waldo': spool directory = /var/log/snort/snort_igb015376 spool filebase = snort_15376_igb0.u2 time_stamp = 1543457151 record_idx = 0
1016Nov 29 08:38:19 	barnyard2 	89958 	Barnyard2 initialization completed successfully (pid=89958)
1017Nov 29 08:38:19 	barnyard2 	89958 	--== Initialization Complete ==--
1018Nov 29 08:38:19 	barnyard2 	89958 	Writing PID "89958" to file "/var/run/barnyard2_igb015376.pid"
1019Nov 29 08:38:19 	barnyard2 	89958 	PID path stat checked out ok, PID path set to /var/run
1020Nov 29 08:38:19 	barnyard2 	89958 	Daemon initialized, signaled parent pid: 89771
1021Nov 29 08:38:19 	barnyard2 	89771 	Daemon parent exiting
1022Nov 29 08:38:19 	barnyard2 	89771 	Initializing daemon mode
1023Nov 29 08:38:19 	barnyard2 	89771 	Configure syslog Priority : [LOG_INFO]
1024Nov 29 08:38:19 	barnyard2 	89771 	Configure syslog Facility : [LOG_USER]
1025Nov 29 08:38:19 	barnyard2 	89771 	Configured to log to local syslog
1026Nov 29 08:38:19 	barnyard2 	89771 	Detail Level: Fast
1027Nov 29 08:38:19 	barnyard2 	89771 	spo_syslog_full config:
1028Nov 29 08:38:19 	barnyard2 	89771 	using operation_mode: default
1029Nov 29 08:38:19 	barnyard2 	89771 	Local logging enabled, WILL NOT send information to a remote syslog
1030Nov 29 08:38:19 	barnyard2 	89771 	Log directory = /var/log/snort/snort_igb015376
1031Nov 29 08:38:19 	barnyard2 	89771 	Barnyard2 spooler: Event cache size set to [8192]
1032Nov 29 08:38:17 	barnyard2 	89771 	---------------------------- +[ Signature Suppress list ]+
1033Nov 29 08:38:17 	barnyard2 	89771 	+[No entry in Signature Suppress List]+
1034Nov 29 08:38:17 	barnyard2 	89771 	+[ Signature Suppress list ]+ ----------------------------
1035Nov 29 08:38:17 	barnyard2 	89771 	Found pid path directive (/var/run)
1036Nov 29 08:38:17 	barnyard2 	89771 	Parsing config file "/usr/local/etc/snort/snort_15376_igb0/barnyard2.conf"
1037Nov 29 08:38:17 	barnyard2 	89771 	Initializing Output Plugins!
1038Nov 29 08:38:17 	barnyard2 	89771 	Initializing Input Plugins!
1039Nov 29 08:38:17 	barnyard2 	89771 	--== Initializing Barnyard2 ==--
1040Nov 29 08:38:17 	barnyard2 	89771 	Running in Continuous mode
1041Nov 29 08:38:17 	barnyard2 	89771 	Found pid path directive (/var/run)
1042Nov 29 08:38:17 	SnortStartup 	89760 	Barnyard2 START for WAN snort protect(15376_igb0)...
1043Nov 29 08:38:11 	kernel 		igb0: promiscuous mode enabled
1044Nov 29 08:38:11 	kernel 		igb2: promiscuous mode enabled
1045Nov 29 08:38:11 	kernel 		igb1: promiscuous mode enabled
1046Nov 29 08:38:09 	avahi-daemon 	73007 	Service "pfSense" (/usr/local/etc/avahi/services/sftp-ssh.service) successfully established.
1047Nov 29 08:38:09 	avahi-daemon 	73007 	Service "pfSense" (/usr/local/etc/avahi/services/ssh.service) successfully established.
1048Nov 29 08:38:09 	avahi-daemon 	73007 	Server startup complete. Host name is pfSense.local. Local service cookie is 705393106.
1049Nov 29 08:38:08 	avahi-daemon 	73007 	Registering HINFO record with values 'AMD64'/'FREEBSD'.
1050Nov 29 08:38:08 	avahi-daemon 	73007 	Registering new address record for 192.168.90.1 on igb1.IPv4.
1051Nov 29 08:38:08 	avahi-daemon 	73007 	Registering new address record for 10.10.10.1 on igb1.IPv4.
1052Nov 29 08:38:08 	avahi-daemon 	73007 	Registering new address record for fe80::20e:c4ff:fed1:6f28 on igb1.*.
1053Nov 29 08:38:08 	avahi-daemon 	73007 	Registering new address record for 192.168.70.1 on igb2.IPv4.
1054Nov 29 08:38:08 	avahi-daemon 	73007 	Registering new address record for fe80::20e:c4ff:fed1:6f29 on igb2.*.
1055Nov 29 08:38:08 	avahi-daemon 	73007 	Network interface enumeration completed.
1056Nov 29 08:38:08 	avahi-daemon 	73007 	New relevant interface igb1.IPv4 for mDNS.
1057Nov 29 08:38:08 	avahi-daemon 	73007 	Joining mDNS multicast group on interface igb1.IPv4 with address 10.10.10.1.
1058Nov 29 08:38:08 	avahi-daemon 	73007 	New relevant interface igb2.IPv4 for mDNS.
1059Nov 29 08:38:08 	avahi-daemon 	73007 	Joining mDNS multicast group on interface igb2.IPv4 with address 192.168.70.1.
1060Nov 29 08:38:08 	avahi-daemon 	73007 	Loading service file /usr/local/etc/avahi/services/ssh.service.
1061Nov 29 08:38:08 	avahi-daemon 	73007 	Loading service file /usr/local/etc/avahi/services/sftp-ssh.service.
1062Nov 29 08:38:08 	avahi-daemon 	73007 	WARNING: No NSS support for mDNS detected, consider installing nss-mdns!
1063Nov 29 08:38:08 	avahi-daemon 	73007 	avahi-daemon 0.7 starting up.
1064Nov 29 08:38:08 	avahi-daemon 	72857 	Failed to create PID file: File exists
1065Nov 29 08:38:08 	avahi-daemon 	72857 	open(/var/run/avahi-daemon//pid): File exists
1066Nov 29 08:38:08 	avahi-daemon 	73007 	Successfully dropped root privileges.
1067Nov 29 08:38:08 	avahi-daemon 	72857 	Successfully dropped root privileges.
1068Nov 29 08:38:08 	avahi-daemon 	73007 	Found user 'avahi' (UID 558) and group 'avahi' (GID 558).
1069Nov 29 08:38:08 	avahi-daemon 	72857 	Found user 'avahi' (UID 558) and group 'avahi' (GID 558).
1070Nov 29 08:38:08 	php-fpm 	339 	/rc.start_packages: Starting service avahi
1071Nov 29 08:38:08 	SnortStartup 	71143 	Snort START for WAN snort protect(15376_igb0)...
1072Nov 29 08:38:08 	php-fpm 	339 	/rc.start_packages: Restarting/Starting all packages.
1073Nov 29 08:38:07 	kernel 		done.
1074Nov 29 08:38:07 	syslogd 		kernel boot file is /boot/kernel/kernel
1075Nov 29 08:38:07 	syslogd 		exiting on signal 15
1076Nov 29 08:38:05 	root 		/etc/rc.d/hostid: WARNING: hostid: unable to figure out a UUID from DMI data, generating a new one
1077Nov 29 08:38:05 	kernel 		done.
1078Nov 29 08:38:05 	php-cgi 		rc.bootup: Creating rrd update script
1079Nov 29 08:38:00 	kernel 		.done.
1080Nov 29 08:38:00 	php-fpm 	340 	/rc.dyndns.update: Dynamic DNS () There was an error trying to determine the public IP for interface - wan (igb0 ).
1081Nov 29 08:37:59 	php-fpm 	340 	/rc.dyndns.update: Dynamic DNS (chudak.no-ip.org) There was an error trying to determine the public IP for interface - wan (igb0 ).
1082Nov 29 08:37:58 	kernel 		....
1083Nov 29 08:37:58 	check_reload_status 		Updating all dyndns
1084Nov 29 08:37:58 	dhcpleases 		kqueue error: unkown
1085Nov 29 08:37:58 	kernel 		done.
1086Nov 29 08:37:58 	kernel 		done.
1087Nov 29 08:37:58 	php-cgi 		rc.bootup: NTPD is starting up.
1088Nov 29 08:37:58 	kernel 		done.
1089Nov 29 08:37:57 	kernel 		done.
1090Nov 29 08:37:57 	kernel 		done.
1091Nov 29 08:37:57 	php-cgi 		rc.bootup: sync unbound done.
1092Nov 29 08:37:56 	kernel 		route: writing to routing socket: Network is unreachable
1093Nov 29 08:37:56 	php-cgi 		rc.bootup: Gateway, none 'available' for inet6, use the first one configured. ''
1094Nov 29 08:37:56 	kernel 		.done.
1095Nov 29 08:37:56 	php-cgi 		rc.bootup: Default gateway setting Interface WAN_DHCP Gateway as default.
1096Nov 29 08:37:55 	php-fpm 	340 	/rc.newwanip: rc.newwanip: on (IP address: 192.168.2.1) (interface: []) (real interface: ovpns1).
1097Nov 29 08:37:55 	php-fpm 	340 	/rc.newwanip: rc.newwanip: Info: starting on ovpns1.
1098Nov 29 08:37:54 	kernel 		....
1099Nov 29 08:37:54 	check_reload_status 		rc.newwanip starting ovpns1
1100Nov 29 08:37:54 	kernel 		pflog0: promiscuous mode enabled
1101Nov 29 08:37:54 	kernel 		ovpns1: link state changed to UP
1102Nov 29 08:37:54 	kernel 		tun1: changing name to 'ovpns1'
1103Nov 29 08:37:54 	php-cgi 		rc.bootup: Resyncing OpenVPN instances.
1104Nov 29 08:37:54 	kernel 		done.
1105Nov 29 08:37:54 	php-cgi 		rc.bootup: The command '/sbin/dhclient -c /var/etc/dhclient_wan.conf igb0 > /tmp/igb0_output 2> /tmp/igb0_error_output' returned exit code '1', the output was ''
1106Nov 29 08:37:44 	syslogd 		Logging subprocess 7368 (exec /usr/local/sbin/sshguard) exited due to signal 15.
1107Nov 29 08:37:44 	sshd 	7277 	Server listening on 0.0.0.0 port 22.
1108Nov 29 08:37:44 	sshd 	7277 	Server listening on :: port 22.
1109Nov 29 08:37:43 	kernel 		coretemp3: <CPU On-Die Thermal Sensors> on cpu3
1110Nov 29 08:37:43 	kernel 		coretemp2: <CPU On-Die Thermal Sensors> on cpu2
1111Nov 29 08:37:43 	kernel 		coretemp1: <CPU On-Die Thermal Sensors> on cpu1
1112Nov 29 08:37:43 	kernel 		coretemp0: <CPU On-Die Thermal Sensors> on cpu0
1113Nov 29 08:37:43 	kernel 		aesni0: <AES-CBC,AES-XTS,AES-GCM,AES-ICM> on motherboard
1114Nov 29 08:37:43 	kernel 		padlock0: No ACE support.
1115Nov 29 08:37:43 	kernel 		TSC: P-state invariant, performance statistics
1116Nov 29 08:37:43 	kernel 		VT-x: PAT,HLT,MTF,PAUSE,EPT,UG,VPID
1117Nov 29 08:37:43 	kernel 		XSAVE Features=0x1<XSAVEOPT>
1118Nov 29 08:37:43 	kernel 		Structured Extended Features3=0x9c000000<IBPB,STIBP,SSBD>
1119Nov 29 08:37:43 	kernel 		Structured Extended Features=0x21c27ab<FSGSBASE,TSCADJ,BMI1,AVX2,SMEP,BMI2,ERMS,INVPCID,NFPUSG,RDSEED,ADX,SMAP,PROCTRACE>
1120Nov 29 08:37:43 	kernel 		AMD Features2=0x121<LAHF,ABM,Prefetch>
1121Nov 29 08:37:43 	kernel 		AMD Features=0x2c100800<SYSCALL,NX,Page1GB,RDTSCP,LM>
1122Nov 29 08:37:43 	kernel 		Features2=0x7ffafbbf<SSE3,PCLMULQDQ,DTES64,MON,DS_CPL,VMX,EST,TM2,SSSE3,SDBG,FMA,CX16,xTPR,PDCM,PCID,SSE4.1,SSE4.2,x2APIC,MOVBE,POPCNT,TSCDLT,AESNI,XSAVE,OSXSAVE,AVX,F16C,RDRAND>
1123Nov 29 08:37:43 	kernel 		Features=0xbfebfbff<FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,CLFLUSH,DTS,ACPI,MMX,FXSR,SSE,SSE2,SS,HTT,TM,PBE>
1124Nov 29 08:37:43 	kernel 		Origin="GenuineIntel" Id=0x306d4 Family=0x6 Model=0x3d Stepping=4
1125Nov 29 08:37:43 	kernel 		CPU: Intel(R) Core(TM) i5-5250U CPU @ 1.60GHz (1596.34-MHz K8-class CPU)
1126Nov 29 08:37:43 	kernel 		random: unblocking device.
1127Nov 29 08:37:43 	kernel 		WARNING: /: mount pending error: blocks 104 files 1
1128Nov 29 08:37:43 	kernel 		WARNING: / was not properly dismounted
1129Nov 29 08:37:43 	kernel 		Trying to mount root from ufs:/dev/ufsid/593033af52fded36 [rw]...
1130Nov 29 08:37:43 	kernel 		ada0: 28626MB (58626288 512 byte sectors)
1131Nov 29 08:37:43 	kernel 		ada0: Command Queueing enabled
1132Nov 29 08:37:43 	kernel 		ada0: 600.000MB/s transfers (SATA 3.x, UDMA6, PIO 8192bytes)
1133Nov 29 08:37:43 	kernel 		ada0: Serial Number CVLI613001ZZ030H
1134Nov 29 08:37:43 	kernel 		ada0: <INTEL SSDMCEAC030B3 LLLi> ACS-2 ATA SATA 3.x device
1135Nov 29 08:37:43 	kernel 		ada0 at ahcich0 bus 0 scbus0 target 0 lun 0
1136Nov 29 08:37:43 	kernel 		uhid0: <Apple Inc. Apple Keyboard, class 0/0, rev 2.00/0.74, addr 3> on usbus0
1137Nov 29 08:37:43 	kernel 		uhid0 on uhub3
1138Nov 29 08:37:43 	kernel 		kbd2 at ukbd0
1139Nov 29 08:37:43 	kernel 		ukbd0: <Apple Inc. Apple Keyboard, class 0/0, rev 2.00/0.74, addr 3> on usbus0
1140Nov 29 08:37:43 	kernel 		ukbd0 on uhub3
1141Nov 29 08:37:43 	kernel 		ugen0.4: <Apple Inc. Apple Keyboard> at usbus0
1142Nov 29 08:37:43 	kernel 		uhub3: 3 ports with 2 removable, bus powered
1143Nov 29 08:37:43 	kernel 		uhub2: 8 ports with 8 removable, self powered
1144Nov 29 08:37:43 	kernel 		uhub3: <Apple, Inc. Keyboard Hub, class 9/0, rev 2.00/96.15, addr 2> on usbus0
1145Nov 29 08:37:43 	kernel 		uhub3 on uhub1
1146Nov 29 08:37:43 	kernel 		ugen0.3: <Apple, Inc. Keyboard Hub> at usbus0
1147Nov 29 08:37:43 	kernel 		uhub2: <vendor 0x8087 product 0x8001, class 9/0, rev 2.00/0.03, addr 2> on usbus1
1148Nov 29 08:37:43 	kernel 		uhub2 on uhub0
1149Nov 29 08:37:43 	kernel 		ugen1.2: <vendor 0x8087 product 0x8001> at usbus1
1150Nov 29 08:37:43 	kernel 		ugen0.2: <Microsoft Microsoft 3-Button Mouse with IntelliEyeTM> at usbus0
1151Nov 29 08:37:43 	kernel 		uhub0: 2 ports with 2 removable, self powered
1152Nov 29 08:37:43 	kernel 		uhub1: 15 ports with 15 removable, self powered
1153Nov 29 08:37:43 	kernel 		uhub1: <0x8086 XHCI root HUB, class 9/0, rev 3.00/1.00, addr 1> on usbus0
1154Nov 29 08:37:43 	kernel 		uhub0: <Intel EHCI root HUB, class 9/0, rev 2.00/1.00, addr 1> on usbus1
1155Nov 29 08:37:43 	kernel 		ugen0.1: <0x8086 XHCI root HUB> at usbus0
1156Nov 29 08:37:43 	kernel 		ugen1.1: <Intel EHCI root HUB> at usbus1
1157Nov 29 08:37:43 	kernel 		pcm1: <Realtek ALC662 (Analog 2.0+HP/2.0)> at nid 20,27 and 24,25 on hdaa1
1158Nov 29 08:37:43 	kernel 		hdaa1: No presence detection support at nid 27
1159Nov 29 08:37:43 	kernel 		hdaa1: <Realtek ALC662 Audio Function Group> at nid 1 on hdacc1
1160Nov 29 08:37:43 	kernel 		hdacc1: <Realtek ALC662 HDA CODEC> at cad 0 on hdac1
1161Nov 29 08:37:43 	kernel 		pcm0: <Intel Broadwell (HDMI/DP 8ch)> at nid 3 on hdaa0
1162Nov 29 08:37:43 	kernel 		hdaa0: <Intel Broadwell Audio Function Group> at nid 1 on hdacc0
1163Nov 29 08:37:43 	kernel 		hdacc0: <Intel Broadwell HDA CODEC> at cad 0 on hdac0
1164Nov 29 08:37:43 	kernel 		Timecounters tick every 1.000 msec
1165Nov 29 08:37:43 	kernel 		est3: <Enhanced SpeedStep Frequency Control> on cpu3
1166Nov 29 08:37:43 	kernel 		est2: <Enhanced SpeedStep Frequency Control> on cpu2
1167Nov 29 08:37:43 	kernel 		est1: <Enhanced SpeedStep Frequency Control> on cpu1
1168Nov 29 08:37:43 	kernel 		est0: <Enhanced SpeedStep Frequency Control> on cpu0
1169Nov 29 08:37:43 	kernel 		ppc0: cannot reserve I/O port range
1170Nov 29 08:37:43 	kernel 		atkbd0: [GIANT-LOCKED]
1171Nov 29 08:37:43 	kernel 		kbd0 at atkbd0
1172Nov 29 08:37:43 	kernel 		atkbd0: <AT Keyboard> irq 1 on atkbdc0
1173Nov 29 08:37:43 	kernel 		atkbdc0: <Keyboard controller (i8042)> at port 0x60,0x64 on isa0
1174Nov 29 08:37:43 	kernel 		uart1: <16950 or compatible> port 0x2f8-0x2ff irq 3 on acpi0
1175Nov 29 08:37:43 	kernel 		uart0: <16950 or compatible> port 0x3f8-0x3ff irq 4 flags 0x10 on acpi0
1176Nov 29 08:37:43 	kernel 		acpi_tz1: <Thermal Zone> on acpi0
1177Nov 29 08:37:43 	kernel 		acpi_tz0: <Thermal Zone> on acpi0
1178Nov 29 08:37:43 	kernel 		acpi_button1: <Power Button> on acpi0
1179Nov 29 08:37:43 	kernel 		acpi_button0: <Sleep Button> on acpi0
1180Nov 29 08:37:43 	kernel 		ahcich0: <AHCI channel> at channel 0 on ahci0
1181Nov 29 08:37:43 	kernel 		ahci0: AHCI v1.30 with 4 6Gbps ports, Port Multiplier not supported
1182Nov 29 08:37:43 	kernel 		ahci0: <AHCI SATA controller> port 0xf0b0-0xf0b7,0xf0a0-0xf0a3,0xf090-0xf097,0xf080-0xf083,0xf060-0xf07f mem 0xf7419000-0xf74197ff irq 19 at device 31.2 on pci0
1183Nov 29 08:37:43 	kernel 		isa0: <ISA bus> on isab0
1184Nov 29 08:37:43 	kernel 		isab0: <PCI-ISA bridge> at device 31.0 on pci0
1185Nov 29 08:37:43 	kernel 		usbus1: 480Mbps High Speed USB v2.0
1186Nov 29 08:37:43 	kernel 		usbus1 on ehci0
1187Nov 29 08:37:43 	kernel 		usbus1: EHCI version 1.0
1188Nov 29 08:37:43 	kernel 		ehci0: <EHCI (generic) USB 2.0 controller> mem 0xf741a000-0xf741a3ff irq 23 at device 29.0 on pci0
1189Nov 29 08:37:43 	kernel 		igb3: netmap queues/slots: TX 2/1024, RX 2/1024
1190Nov 29 08:37:43 	kernel 		igb3: Bound queue 1 to cpu 3
1191Nov 29 08:37:43 	kernel 		igb3: Bound queue 0 to cpu 2
1192Nov 29 08:37:43 	kernel 		igb3: Ethernet address: 00:0e:c4:d1:6f:2a
1193Nov 29 08:37:43 	kernel 		igb3: Using MSIX interrupts with 3 vectors
1194Nov 29 08:37:43 	kernel 		igb3: <Intel(R) PRO/1000 Network Connection, Version - 2.5.3-k> port 0xb000-0xb01f mem 0xf7000000-0xf701ffff,0xf7020000-0xf7023fff irq 16 at device 0.0 on pci4
1195Nov 29 08:37:43 	kernel 		pci4: <ACPI PCI bus> on pcib4
1196Nov 29 08:37:43 	kernel 		pcib4: <ACPI PCI-PCI bridge> irq 16 at device 28.4 on pci0
1197Nov 29 08:37:43 	kernel 		igb2: netmap queues/slots: TX 2/1024, RX 2/1024
1198Nov 29 08:37:43 	kernel 		igb2: Bound queue 1 to cpu 1
1199Nov 29 08:37:43 	kernel 		igb2: Bound queue 0 to cpu 0
1200Nov 29 08:37:43 	kernel 		igb2: Ethernet address: 00:0e:c4:d1:6f:29
1201Nov 29 08:37:43 	kernel 		igb2: Using MSIX interrupts with 3 vectors
1202Nov 29 08:37:43 	kernel 		igb2: <Intel(R) PRO/1000 Network Connection, Version - 2.5.3-k> port 0xc000-0xc01f mem 0xf7100000-0xf711ffff,0xf7120000-0xf7123fff irq 18 at device 0.0 on pci3
1203Nov 29 08:37:43 	kernel 		pci3: <ACPI PCI bus> on pcib3
1204Nov 29 08:37:43 	kernel 		pcib3: <ACPI PCI-PCI bridge> irq 18 at device 28.2 on pci0
1205Nov 29 08:37:43 	kernel 		igb1: netmap queues/slots: TX 2/1024, RX 2/1024
1206Nov 29 08:37:43 	kernel 		igb1: Bound queue 1 to cpu 3
1207Nov 29 08:37:43 	kernel 		igb1: Bound queue 0 to cpu 2
1208Nov 29 08:37:43 	kernel 		igb1: Ethernet address: 00:0e:c4:d1:6f:28
1209Nov 29 08:37:43 	kernel 		igb1: Using MSIX interrupts with 3 vectors
1210Nov 29 08:37:43 	kernel 		igb1: <Intel(R) PRO/1000 Network Connection, Version - 2.5.3-k> port 0xd000-0xd01f mem 0xf7200000-0xf721ffff,0xf7220000-0xf7223fff irq 17 at device 0.0 on pci2
1211Nov 29 08:37:43 	kernel 		pci2: <ACPI PCI bus> on pcib2
1212Nov 29 08:37:43 	kernel 		pcib2: <ACPI PCI-PCI bridge> irq 17 at device 28.1 on pci0
1213Nov 29 08:37:43 	kernel 		igb0: netmap queues/slots: TX 2/1024, RX 2/1024
1214Nov 29 08:37:43 	kernel 		igb0: Bound queue 1 to cpu 1
1215Nov 29 08:37:43 	kernel 		igb0: Bound queue 0 to cpu 0
1216Nov 29 08:37:43 	kernel 		igb0: Ethernet address: 00:0e:c4:d1:6f:27
1217Nov 29 08:37:43 	kernel 		igb0: Using MSIX interrupts with 3 vectors
1218Nov 29 08:37:43 	kernel 		igb0: <Intel(R) PRO/1000 Network Connection, Version - 2.5.3-k> port 0xe000-0xe01f mem 0xf7300000-0xf731ffff,0xf7320000-0xf7323fff irq 16 at device 0.0 on pci1
1219Nov 29 08:37:43 	kernel 		pci1: <ACPI PCI bus> on pcib1
1220Nov 29 08:37:43 	kernel 		pcib1: <ACPI PCI-PCI bridge> irq 16 at device 28.0 on pci0
1221Nov 29 08:37:43 	kernel 		hdac1: <Intel Broadwell HDA Controller> mem 0xf7410000-0xf7413fff irq 22 at device 27.0 on pci0
1222Nov 29 08:37:43 	kernel 		pci0: <simple comms> at device 22.0 (no driver attached)
1223Nov 29 08:37:43 	kernel 		usbus0: 5.0Gbps Super Speed USB v3.0
1224Nov 29 08:37:43 	kernel 		usbus0 on xhci0
1225Nov 29 08:37:43 	kernel 		xhci0: Port routing mask set to 0xffffffff
1226Nov 29 08:37:43 	kernel 		xhci0: 32 bytes context size, 64-bit DMA
1227Nov 29 08:37:43 	kernel 		xhci0: <Broadwell Integrated PCH-LP chipset USB 3.0 controller> mem 0xf7400000-0xf740ffff irq 21 at device 20.0 on pci0
1228Nov 29 08:37:43 	kernel 		hdac0: <Intel Broadwell HDA Controller> mem 0xf7414000-0xf7417fff irq 16 at device 3.0 on pci0
1229Nov 29 08:37:43 	kernel 		vgapci0: Boot video device
1230Nov 29 08:37:43 	kernel 		vgapci0: <VGA-compatible display> port 0xf000-0xf03f mem 0xf6000000-0xf6ffffff,0xe0000000-0xefffffff irq 16 at device 2.0 on pci0
1231Nov 29 08:37:43 	kernel 		pci0: <ACPI PCI bus> on pcib0
1232Nov 29 08:37:43 	kernel 		pcib0: <ACPI Host-PCI bridge> port 0xcf8-0xcff on acpi0
1233Nov 29 08:37:43 	kernel 		acpi_timer0: <24-bit timer at 3.579545MHz> port 0x1808-0x180b on acpi0
1234Nov 29 08:37:43 	kernel 		Timecounter "ACPI-fast" frequency 3579545 Hz quality 900
1235Nov 29 08:37:43 	kernel 		Event timer "i8254" frequency 1193182 Hz quality 100
1236Nov 29 08:37:43 	kernel 		Timecounter "i8254" frequency 1193182 Hz quality 0
1237Nov 29 08:37:43 	kernel 		attimer0: <AT timer> port 0x40-0x43,0x50-0x53 irq 0 on acpi0
1238Nov 29 08:37:43 	kernel 		Event timer "RTC" frequency 32768 Hz quality 0
1239Nov 29 08:37:43 	kernel 		atrtc0: registered as a time-of-day clock, resolution 1.000000s
1240Nov 29 08:37:43 	kernel 		atrtc0: Warning: Couldn't map I/O.
1241Nov 29 08:37:43 	kernel 		atrtc0: <AT realtime clock> port 0x70-0x77 irq 8 on acpi0
1242Nov 29 08:37:43 	kernel 		Event timer "HPET4" frequency 14318180 Hz quality 440
1243Nov 29 08:37:43 	kernel 		Event timer "HPET3" frequency 14318180 Hz quality 440
1244Nov 29 08:37:43 	kernel 		Event timer "HPET2" frequency 14318180 Hz quality 440
1245Nov 29 08:37:43 	kernel 		Event timer "HPET1" frequency 14318180 Hz quality 440
1246Nov 29 08:37:43 	kernel 		Event timer "HPET" frequency 14318180 Hz quality 550
1247Nov 29 08:37:43 	kernel 		Timecounter "HPET" frequency 14318180 Hz quality 950
1248Nov 29 08:37:43 	kernel 		hpet0: <High Precision Event Timer> iomem 0xfed00000-0xfed003ff on acpi0
1249Nov 29 08:37:43 	kernel 		cpu3: <ACPI CPU> on acpi0
1250Nov 29 08:37:43 	kernel 		cpu2: <ACPI CPU> on acpi0
1251Nov 29 08:37:43 	kernel 		cpu1: <ACPI CPU> on acpi0
1252Nov 29 08:37:43 	kernel 		cpu0: <ACPI CPU> on acpi0
1253Nov 29 08:37:43 	kernel 		acpi0: Power Button (fixed)
1254Nov 29 08:37:43 	kernel 		acpi0: <ALASKA A M I > on motherboard
1255Nov 29 08:37:43 	kernel 		padlock0: No ACE support.
1256Nov 29 08:37:43 	kernel 		cryptosoft0: <software crypto> on motherboard
1257Nov 29 08:37:43 	kernel 		vtvga0: <VT VGA driver> on motherboard
1258Nov 29 08:37:43 	kernel 		nexus0
1259Nov 29 08:37:43 	kernel 		random: fast provider: "Intel Secure Key RNG"
1260Nov 29 08:37:43 	kernel 		random: registering fast source Intel Secure Key RNG
1261Nov 29 08:37:43 	kernel 		module_register_init: MOD_LOAD (vesa, 0xffffffff81209800, 0) error 19
1262Nov 29 08:37:43 	kernel 		netmap: loaded module
1263Nov 29 08:37:43 	kernel 		kbd1 at kbdmux0
1264Nov 29 08:37:43 	kernel 		hn: tranparent VF mode, if_transmit will be used, instead of if_start
1265Nov 29 08:37:43 	kernel 		wlan: mac acl policy registered
1266Nov 29 08:37:43 	kernel 		module_register_init: MOD_LOAD (iwi_monitor_fw, 0xffffffff806a75c0, 0) error 1
1267Nov 29 08:37:43 	kernel 		iwi_monitor: If you agree with the license, set legal.intel_iwi.license_ack=1 in /boot/loader.conf.
1268Nov 29 08:37:43 	kernel 		iwi_monitor: You need to read the LICENSE file in /usr/share/doc/legal/intel_iwi.LICENSE.
1269Nov 29 08:37:43 	kernel 		module_register_init: MOD_LOAD (iwi_ibss_fw, 0xffffffff806a7510, 0) error 1
1270Nov 29 08:37:43 	kernel 		iwi_ibss: If you agree with the license, set legal.intel_iwi.license_ack=1 in /boot/loader.conf.
1271Nov 29 08:37:43 	kernel 		iwi_ibss: You need to read the LICENSE file in /usr/share/doc/legal/intel_iwi.LICENSE.
1272Nov 29 08:37:43 	kernel 		module_register_init: MOD_LOAD (iwi_bss_fw, 0xffffffff806a7460, 0) error 1
1273Nov 29 08:37:43 	kernel 		iwi_bss: If you agree with the license, set legal.intel_iwi.license_ack=1 in /boot/loader.conf.
1274Nov 29 08:37:43 	kernel 		iwi_bss: You need to read the LICENSE file in /usr/share/doc/legal/intel_iwi.LICENSE.
1275Nov 29 08:37:43 	kernel 		module_register_init: MOD_LOAD (ipw_monitor_fw, 0xffffffff80680590, 0) error 1
1276Nov 29 08:37:43 	kernel 		ipw_monitor: If you agree with the license, set legal.intel_ipw.license_ack=1 in /boot/loader.conf.
1277Nov 29 08:37:43 	kernel 		ipw_monitor: You need to read the LICENSE file in /usr/share/doc/legal/intel_ipw.LICENSE.
1278Nov 29 08:37:43 	kernel 		module_register_init: MOD_LOAD (ipw_ibss_fw, 0xffffffff806804e0, 0) error 1
1279Nov 29 08:37:43 	kernel 		ipw_ibss: If you agree with the license, set legal.intel_ipw.license_ack=1 in /boot/loader.conf.
1280Nov 29 08:37:43 	kernel 		ipw_ibss: You need to read the LICENSE file in /usr/share/doc/legal/intel_ipw.LICENSE.
1281Nov 29 08:37:43 	kernel 		random: entropy device external interface
1282Nov 29 08:37:43 	kernel 		module_register_init: MOD_LOAD (ipw_bss_fw, 0xffffffff80680430, 0) error 1
1283Nov 29 08:37:43 	kernel 		ipw_bss: If you agree with the license, set legal.intel_ipw.license_ack=1 in /boot/loader.conf.
1284Nov 29 08:37:43 	kernel 		ipw_bss: You need to read the LICENSE file in /usr/share/doc/legal/intel_ipw.LICENSE.
1285Nov 29 08:37:43 	kernel 		Timecounter "TSC" frequency 1596335482 Hz quality 1000
1286Nov 29 08:37:43 	kernel 		SMP: AP CPU #2 Launched!
1287Nov 29 08:37:43 	kernel 		SMP: AP CPU #3 Launched!
1288Nov 29 08:37:43 	kernel 		SMP: AP CPU #1 Launched!
1289Nov 29 08:37:43 	kernel 		ioapic0 <Version 2.0> irqs 0-39 on motherboard
1290Nov 29 08:37:43 	kernel 		WARNING: Bogus Interrupt Trigger Mode. Assume CONFORMS.
1291Nov 29 08:37:43 	kernel 		WARNING: Bogus Interrupt Trigger Mode. Assume CONFORMS.
1292Nov 29 08:37:43 	kernel 		WARNING: Bogus Interrupt Polarity. Assume CONFORMS
1293Nov 29 08:37:43 	kernel 		WARNING: Bogus Interrupt Trigger Mode. Assume CONFORMS.
1294Nov 29 08:37:43 	kernel 		FreeBSD/SMP: 1 package(s) x 2 core(s) x 2 hardware threads
1295Nov 29 08:37:43 	kernel 		FreeBSD/SMP: Multiprocessor System Detected: 4 CPUs
1296Nov 29 08:37:43 	kernel 		ACPI APIC Table: <ALASKA A M I >
1297Nov 29 08:37:43 	kernel 		Event timer "LAPIC" quality 600
1298Nov 29 08:37:43 	kernel 		avail memory = 8166854656 (7788 MB)
1299Nov 29 08:37:43 	kernel 		real memory = 8589934592 (8192 MB)
1300Nov 29 08:37:43 	kernel 		TSC: P-state invariant, performance statistics
1301Nov 29 08:37:43 	kernel 		VT-x: PAT,HLT,MTF,PAUSE,EPT,UG,VPID
1302Nov 29 08:37:43 	kernel 		XSAVE Features=0x1<XSAVEOPT>
1303Nov 29 08:37:43 	kernel 		Structured Extended Features=0x21c27ab<FSGSBASE,TSCADJ,BMI1,AVX2,SMEP,BMI2,ERMS,INVPCID,NFPUSG,RDSEED,ADX,SMAP,PROCTRACE>
1304Nov 29 08:37:43 	kernel 		AMD Features2=0x121<LAHF,ABM,Prefetch>
1305Nov 29 08:37:43 	kernel 		AMD Features=0x2c100800<SYSCALL,NX,Page1GB,RDTSCP,LM>
1306Nov 29 08:37:43 	kernel 		Features2=0x7ffafbbf<SSE3,PCLMULQDQ,DTES64,MON,DS_CPL,VMX,EST,TM2,SSSE3,SDBG,FMA,CX16,xTPR,PDCM,PCID,SSE4.1,SSE4.2,x2APIC,MOVBE,POPCNT,TSCDLT,AESNI,XSAVE,OSXSAVE,AVX,F16C,RDRAND>
1307Nov 29 08:37:43 	kernel 		Features=0xbfebfbff<FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,CLFLUSH,DTS,ACPI,MMX,FXSR,SSE,SSE2,SS,HTT,TM,PBE>
1308Nov 29 08:37:43 	kernel 		Origin="GenuineIntel" Id=0x306d4 Family=0x6 Model=0x3d Stepping=4
1309Nov 29 08:37:43 	kernel 		CPU: Intel(R) Core(TM) i5-5250U CPU @ 1.60GHz (1596.34-MHz K8-class CPU)
1310Nov 29 08:37:43 	kernel 		VT(vga): resolution 640x480
1311Nov 29 08:37:43 	kernel 		FreeBSD clang version 6.0.0 (tags/RELEASE_600/final 326565) (based on LLVM 6.0.0)
1312Nov 29 08:37:43 	kernel 		root@buildbot3:/crossbuild/ce-244/obj/amd64/WvDslnYb/crossbuild/ce-244/pfSense/tmp/FreeBSD-src/sys/pfSense amd64
1313Nov 29 08:37:43 	kernel 		FreeBSD 11.2-RELEASE-p3 #17 e6b497fa0a3(RELENG_2_4_4): Thu Sep 20 09:04:45 EDT 2018
1314Nov 29 08:37:43 	kernel 		FreeBSD is a registered trademark of The FreeBSD Foundation.
1315Nov 29 08:37:43 	kernel 		The Regents of the University of California. All rights reserved.
1316Nov 29 08:37:43 	kernel 		Copyright (c) 1979, 1980, 1983, 1986, 1988, 1989, 1991, 1992, 1993, 1994
1317Nov 29 08:37:43 	kernel 		Copyright (c) 1992-2018 The FreeBSD Project.
1318Nov 29 08:37:43 	syslogd 		kernel boot file is /boot/kernel/kernel
1319Nov 28 23:18:17 	php-fpm 		/index.php: Successful login for user 'admin' from: 192.168.2.6 (Local Database)
1320Nov 28 23:18:03 	sshguard 	51060 	Attack from "192.168.2.6" on service 380 with danger 10.
1321Nov 28 23:18:03 	php-fpm 		/index.php: webConfigurator authentication error for user 'yuriw' from: 192.168.2.6
1322Nov 28 21:38:16 	check_reload_status 		Reloading filter
1323Nov 28 21:38:16 	dhcpleases 		/etc/hosts changed size from original!
1324Nov 28 21:38:16 	avahi-daemon 	28585 	Registering new address record for 10.10.10.1 on igb1.IPv4.
1325Nov 28 21:38:16 	avahi-daemon 	28585 	Withdrawing address record for 10.10.10.1 on igb1.
1326Nov 28 21:38:16 	php-fpm 		/rc.newwanip: rc.newwanip: on (IP address: 192.168.90.1) (interface: LAN[lan]) (real interface: igb1).
1327Nov 28 21:38:16 	php-fpm 		/rc.newwanip: rc.newwanip: Info: starting on igb1.
1328Nov 28 21:38:15 	check_reload_status 		Reloading filter
1329Nov 28 21:38:15 	check_reload_status 		rc.newwanip starting igb1
1330Nov 28 21:38:15 	php-fpm 		/rc.linkup: Hotplug event detected for LAN(lan) static IP (192.168.90.1 )
1331Nov 28 21:38:14 	check_reload_status 		Linkup starting igb1
1332Nov 28 21:38:14 	kernel 		igb1: link state changed to UP
1333Nov 28 21:38:11 	check_reload_status 		Reloading filter
1334Nov 28 21:38:11 	php-fpm 		/rc.linkup: Hotplug event detected for LAN(lan) static IP (192.168.90.1 )
1335Nov 28 21:38:10 	kernel 		igb1: link state changed to DOWN
1336Nov 28 21:38:10 	check_reload_status 		Linkup starting igb1
1337Nov 28 20:30:54 	php-fpm 	84259 	/index.php: Successful login for user 'admin' from: 192.168.70.28 (Local Database)
1338Nov 28 19:25:21 	check_reload_status 		Reloading filter