• Support
  • Forums
  • Blogs

suricata stops and starts


Space invader
Trying to get suricata working on two stand alone (not DB, FW, SRV) systems. Running 4.1.2 on them as well as the main AV server. This is all the open source versions.

Suricata will run on sensor 1 for 5 minutes or so, then crash. I get events in the server when it is running so I know it is ok that way. I can't seem to find anything in the log files though to tell me what is happening.

Sensor 1 has 2 dual core CPU and 6G of RAM. It is running two interfaces, one is copper ethernet at 1G and the other is a bonded fiber from a netowkr tap.

Sensor 2 has 1 dual core CPU and 2 G of ram. It shows suricata running, but none of the events are showing up in the server. I get Ossec events from it first thing in the morning after some cron jobs run, or after a reboot. After a reboot i get some snort/suricata events.

And yes, the sensor interfaces are separate from the management ones.

I've been fighting with these since the upgrade to 4.0 with snort being the problem child before which was why i switched to suricata. I managed to get suricata working, which I could not do with snort, but still having some of these issues.

Any debugging help would be appreciated. I will also continue to work on this myself.


Share post:

This discussion has been closed.