I haven't played much with snort, but have you checked the RAW logs which Snort outputs? It could be "BASE" not interpreting the logs in a correct way, since I assume that the rules hasn't changed much from 2.9.0.1 to 2.9.0.2
Did you try asking this question at:
https://forums.snort.org/ ?
There is also a Snort emailing list, where you can submit emails to and get a much more appropriate response as well.
In essence, the problem is most likely located in:
A) BASE - The log parser / interpreter (likely)
B) The Snort rules (unlikely)
C) A setting within Snort, which you did not specify to your needs. (likely)
This is just my random guess at what seems to be most likely wrong.
To resolve problem C, check the user documentation. (It's quite long and well described.)
General Certification : CPT Practical Submission
