Still seeing suricata stop an interface due to .pid error



  • 7/6/2018 -- 12:55:39 - <Notice> -- This is Suricata version 4.0.4 RELEASE
    7/6/2018 -- 12:55:39 - <Info> -- CPUs/cores online: 2
    7/6/2018 -- 12:55:39 - <Info> -- HTTP memcap: 67108864
    7/6/2018 -- 12:55:39 - <Notice> -- using flow hash instead of active packets
    7/6/2018 -- 12:55:39 - <Error> -- [ERRCODE: SC_ERR_INITIALIZATION(45)] - pid file '/var/run/suricata_mvneta210310.pid' exists but appears stale. Make sure Suricata is not running and then remove /var/run/suricata_mvneta210310.pid. Aborting!

    Then when I stop the service, the file's gone. Restart. Crashes with same error.



  • This post is deleted!


  • I've deleted my previous update. It's still not working.

    I'm basically using the same parameters and lists in snort. But trying to config suricata, I can get alerts working but as soon as I enable blocking the interface service dies.



  • Is it this bug in 2.4.3_1 by chance?
    https://redmine.pfsense.org/issues/8518
    (rule syntax error on incomplete rule (missing IPs): "There were error(s) loading the rules: /tmp/rules.debug:371: syntax error - The line in question reads [371]: pass out route-to ( vmx0 xx.xx.xx.xx ) from to !/ tracker 1000027964 keep state allow-opts label "let out anything from firewall host itself"; @ ...")



  • I started having this same problem since yesterday:

    7/9/2018 -- 22:42:06 - <Notice> -- This is Suricata version 4.0.5 RELEASE
    7/9/2018 -- 22:42:06 - <Info> -- CPUs/cores online: 4
    7/9/2018 -- 22:42:06 - <Info> -- HTTP memcap: 67108864
    7/9/2018 -- 22:42:06 - <Notice> -- using flow hash instead of active packets
    7/9/2018 -- 22:42:06 - <Error> -- [ERRCODE: SC_ERR_INITIALIZATION(45)] - pid file '/var/run/suricata_pppoe030843.pid' exists but appears stale. Make sure Suricata is not running and then remove /var/run/suricata_pppoe030843.pid. Aborting!
    

    Running pfSense 2.4.3-RELEASE-p1.



  • @occamsrazor said in Still seeing suricata stop an interface due to .pid error:

    I started having this same problem since yesterday:

    7/9/2018 -- 22:42:06 - <Notice> -- This is Suricata version 4.0.5 RELEASE
    7/9/2018 -- 22:42:06 - <Info> -- CPUs/cores online: 4
    7/9/2018 -- 22:42:06 - <Info> -- HTTP memcap: 67108864
    7/9/2018 -- 22:42:06 - <Notice> -- using flow hash instead of active packets
    7/9/2018 -- 22:42:06 - <Error> -- [ERRCODE: SC_ERR_INITIALIZATION(45)] - pid file '/var/run/suricata_pppoe030843.pid' exists but appears stale. Make sure Suricata is not running and then remove /var/run/suricata_pppoe030843.pid. Aborting!
    

    Running pfSense 2.4.3-RELEASE-p1.

    You can try manually deleting that PID file and try the start again. If it fails to start again, look carefully through the suricata.log file and the system log to see what errors are being posted.



  • @bmeeks

    I actually found some of your advice in an older thread:
    https://forum.netgate.com/topic/120647/suricata-crash-on-latest-2-4-0-rc/6
    ..and doubled the Stream Mem Cap setting to 134217728. PS - I have 8GB RAM.
    Perhaps too soon to really tell, but so far it seems to have fixed the problem.