AlienVault v5.1.1 is now available for OSSIM and USM. Learn more
Check out the new Open Threat Exchange (OTX) - with social sharing of threat data. Sign up today
suricata stops and starts
Trying to get suricata working on two stand alone (not DB, FW, SRV) systems. Running 4.1.2 on them as well as the main AV server. This is all the open source versions.
Suricata will run on sensor 1 for 5 minutes or so, then crash. I get events in the server when it is running so I know it is ok that way. I can't seem to find anything in the log files though to tell me what is happening.
Sensor 1 has 2 dual core CPU and 6G of RAM. It is running two interfaces, one is copper ethernet at 1G and the other is a bonded fiber from a netowkr tap.
Sensor 2 has 1 dual core CPU and 2 G of ram. It shows suricata running, but none of the events are showing up in the server. I get Ossec events from it first thing in the morning after some cron jobs run, or after a reboot. After a reboot i get some snort/suricata events.
And yes, the sensor interfaces are separate from the management ones.
I've been fighting with these since the upgrade to 4.0 with snort being the problem child before which was why i switched to suricata. I managed to get suricata working, which I could not do with snort, but still having some of these issues.
Any debugging help would be appreciated. I will also continue to work on this myself.