Still seeing suricata stop an interface due to .pid error
7/6/2018 – 12:55:39 - <Notice> – This is Suricata version 4.0.4 RELEASE
7/6/2018 – 12:55:39 - <Info> – CPUs/cores online: 2
7/6/2018 – 12:55:39 - <Info> – HTTP memcap: 67108864
7/6/2018 – 12:55:39 - <Notice> – using flow hash instead of active packets
7/6/2018 – 12:55:39 - <Error> – [ERRCODE: SC_ERR_INITIALIZATION(45)] - pid file ‘/var/run/suricata_mvneta210310.pid’ exists but appears stale. Make sure Suricata is not running and then remove /var/run/suricata_mvneta210310.pid. Aborting!
Then when I stop the service, the file’s gone. Restart. Crashes with same error.
This post is deleted!
I’ve deleted my previous update. It’s still not working.
I’m basically using the same parameters and lists in snort. But trying to config suricata, I can get alerts working but as soon as I enable blocking the interface service dies.
teamits last edited by
Is it this bug in 2.4.3_1 by chance?
(rule syntax error on incomplete rule (missing IPs): “There were error(s) loading the rules: /tmp/rules.debug:371: syntax error - The line in question reads : pass out route-to ( vmx0 xx.xx.xx.xx ) from to !/ tracker 1000027964 keep state allow-opts label “let out anything from firewall host itself”; @ …”)