Suricata wont start
-
long story short.. I reinstalled pfsense beta. 2.4.3-DEVELOPMENT (amd64)
made changes to nic's.. turned on aes hardware. rebooted.. suricata stopped working..
deleted all of suricata and unchecked keep settings when you uninstall..
reinstall package and all the settings returned.. so I repeated with the uninstall part..deleted anything to do with suracata var/db etc… with the rm command..
installed again and settings still there.. what am I doing wrong?
anyone else?
-
The better place the start threads about the IDS/IPS packages is in that sub-forum, but since we are here I will reply here.
The first thing that usually causes Suricata to fail startup is not enough memory allocated to the Stream Memcap option. The default is 32 MB, but that number has to increase quite a bit if your CPU has more than 4 cores. Most folks with 6-core and 8-core CPUs get best results by upping that value to 256 MB. You will find that setting on the FLOW/STREAM tab for the affected Suricata interface.
Bill
-
For stream men cap default is 64MB. Flow mem cap is 32MB
