Still seeing suricata stop an interface due to .pid error



  • 7/6/2018 -- 12:55:39 - <Notice> -- This is Suricata version 4.0.4 RELEASE
    7/6/2018 -- 12:55:39 - <Info> -- CPUs/cores online: 2
    7/6/2018 -- 12:55:39 - <Info> -- HTTP memcap: 67108864
    7/6/2018 -- 12:55:39 - <Notice> -- using flow hash instead of active packets
    7/6/2018 -- 12:55:39 - <Error> -- [ERRCODE: SC_ERR_INITIALIZATION(45)] - pid file '/var/run/suricata_mvneta210310.pid' exists but appears stale. Make sure Suricata is not running and then remove /var/run/suricata_mvneta210310.pid. Aborting!

    Then when I stop the service, the file's gone. Restart. Crashes with same error.



  • This post is deleted!


  • I've deleted my previous update. It's still not working.

    I'm basically using the same parameters and lists in snort. But trying to config suricata, I can get alerts working but as soon as I enable blocking the interface service dies.



  • Is it this bug in 2.4.3_1 by chance?
    https://redmine.pfsense.org/issues/8518
    (rule syntax error on incomplete rule (missing IPs): "There were error(s) loading the rules: /tmp/rules.debug:371: syntax error - The line in question reads [371]: pass out route-to ( vmx0 xx.xx.xx.xx ) from to !/ tracker 1000027964 keep state allow-opts label "let out anything from firewall host itself"; @ ...")


 

© Copyright 2002 - 2018 Rubicon Communications, LLC | Privacy Policy