Navigation

    Netgate Discussion Forum
    • Register
    • Login
    • Search
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search

    Suricata found disabled

    IDS/IPS
    3
    5
    89
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • C
      cybersec_s last edited by cybersec_s

      I have noticed that mt suricata service keep deactivating. and I must reboot my netgate 1100 to start the service. I am one pfsense version 22.05 and my rules are aup to date has anyone experienced this. if so, what was done to resolve the issue?
      pfsense suricata state.png

      S 1 Reply Last reply Reply Quote 0
      • bmeeks
        bmeeks last edited by

        Are you updated to the latest version of the Suricata package? What specific version of Suricata is installed?

        Have you examined the suricata.log file for the interface? You can access it under LOGS VIEW, choosing the correct interface in the drop-down, and then choosing the suricata.log for viewing in the log files drop-down. Posting the contents of that log would be helpful.

        Examine the pfSense system log to see if anything related to Suricata is logged there. If you find anything, post it back here.

        1 Reply Last reply Reply Quote 0
        • S
          SteveITS @cybersec_s last edited by

          @cybersec_s said in Suricata found disabled:

          I must reboot my netgate 1100

          The 1100 has only 1 GB RAM so it could be an out of memory issue.

          Only a reboot fixes it? What happens when you press the (>) button to start Suricata?

          Steve

          Only install packages for your version, or risk breaking it. If yours is older, select it in System/Update/Update Settings.
          When upgrading, let it finish; do not reboot early. Allow 10-15 minutes, or more depending on packages and device speed.

          C 1 Reply Last reply Reply Quote 0
          • C
            cybersec_s @SteveITS last edited by

            @steveits Thanks for your reply. I figured out my issue. I'm using my device in transparant mode and had it configured incorrectly. I have the WAN and LAN ports bridged and also had IP's on both ports. once I removed the IP's and placed one on the Bridge(for local gui access) the service stayed active asfter a reboot.

            bmeeks 1 Reply Last reply Reply Quote 0
            • bmeeks
              bmeeks @cybersec_s last edited by bmeeks

              @cybersec_s said in Suricata found disabled:

              @steveits Thanks for your reply. I figured out my issue. I'm using my device in transparant mode and had it configured incorrectly. I have the WAN and LAN ports bridged and also had IP's on both ports. once I removed the IP's and placed one on the Bridge(for local gui access) the service stayed active asfter a reboot.

              Be warned that Suricata (or Snort) does not like bridged interfaces. The service may start, but actual performance there may be questionable. Officially from upstream, off-norm interfaces such as bridges, LAGGs, etc., are not supported by Suricata.

              1 Reply Last reply Reply Quote 1
              • First post
                Last post