I've been trying to set up custom alerts on my DMZ interface, anyone done anything similar ?
Go into the DMZ interface under Snort.
Category Selection and select custom rules.
Added "alert icmp any any -> any any (msg:"ICMP Packet found";sid:1000001;rev:1)"
Saved then restarted snort on the DMZ interface.
It appears to be running fine till the first ICMP when snort exits with a signal 11.
You are missing the CLASSIFICATION field in your rule. I think due to some custom patches applied in the distant past to the CSV logging code in the Snort binary, certain missing fields in rule signatures cause NULL pointer issues and subsequent crashes. I thought I had fixed those, but perhaps some bugs still survive. I did not write that original code, but have been maintaining it for about three years.
I have this report along with some others to look at that all seem related to the same core issue. I will look into it for the next Snort update.