@enicolau said in suricata not starting:
@bmeeks Thanks for responding, I'm using pfsense, from the gui there is no more data that it doesn't start, there is nothing else, so I start it by ssh but I can't think of much else
I don't think you understand how Suricata works on pfSense. You MUST use the GUI for everything. You CANNOT do things from the command-line -- including starting it by SSH. The suricata.yaml file you see in /usr/local/etc/suricata is not the file used by the Suricata processes on pfSense. Each configured instance (in the GUI) has its own unique subdirectory underneath /usr/local/etc/suricata/, and all of the configuration information for that instance resides in the subdirectory. At startup time, the suricata.yaml file is created from scratch using information stored by the GUI code in the firewall's config.xml file.
The errors in the startup log clearly indicate issues with your NIC driver. It is not playing well with Suricata. I have no idea why, but it is not. Notice these two lines:
27/1/2022 -- 08:44:41 - <Error> - [ERRCODE: SC_ERR_THREAD_INIT(49)] - thread "RX#01-vtnet1" failed to initialize: flags 0145
27/1/2022 -- 08:44:41 - <Error> - [ERRCODE: SC_ERR_FATAL(171)] - Engine initialization failed, aborting...
That SC_ERR_FATAL error is why Suricata is not starting, and that error is ocurring when Suricata attempts to initialize that card.
Your second problem is attempting to run Suricata using the UNIX socket. That is not currently supported on pfSense.
27/1/2022 -- 08:46:55 - <Info> - Running in live mode, activating unix socket
27/1/2022 -- 08:46:55 - <Info> - Using unix socket file '/var/run/suricata/suricata-command.socket'
And you appear to be trying to pass BPF parameters via the command-line based on this line in the startup log:
27/1/2022 -- 08:46:55 - <Info> - BPF filter set from command line or via old 'bpf-filter' option.
That option is not supported on pfSense either. And the filter you are providing has a syntax error as evidenced by this line in the log file:
27/1/2022 -- 08:44:41 - <Error> - [ERRCODE: SC_ERR_BPF(127)] - bpf compilation error can't parse filter expression: syntax error
Here is a link with instructions for setting up Suricata on pfSense. It may help you understand how to properly do this.
https://lawrencesystems.com/suricata-network-ids-ips-installation-setup-and-how-to-tune-the-rules-alerts-on-pfsense-2020/