# Disable rules by SID not working

**URL:** <https://forum.suricata.io/t/disable-rules-by-sid-not-working/4526>\
**Category:** Uncategorized\
**Created:** [March 14, 2024, 3:59pm UTC](https://forum.suricata.io/t/disable-rules-by-sid-not-working/4526 "2024-03-14T15:59:14Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![gbL2k](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/gbl2k/32/2732_2.png) [@gbL2k](https://forum.suricata.io/u/gbL2k)\
**Post date:** [March 14, 2024, 3:59pm UTC](https://forum.suricata.io/t/disable-rules-by-sid-not-working/4526/1 "2024-03-14T15:59:14Z")

</div>

I created the disable.conf and placed some sid’s in it that I want to disable.  
When I run suricata-update it says that the rules have been disabled and the rules are event commented out in suricata.rules.But still I get alerts with that sid.

Thanks in advance!

---

<div class="post-metadata">

**Author:** ![gbL2k](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/gbl2k/32/2732_2.png) [@gbL2k](https://forum.suricata.io/u/gbL2k)\
**Post date:** [March 15, 2024, 12:41pm UTC](https://forum.suricata.io/t/disable-rules-by-sid-not-working/4526/2 "2024-03-15T12:41:40Z")

</div>

My disable.conf looks like the following:

```auto
2013929
2013926
2027390
group:app-layer-events.rules
group:decoder-events.rules
group:dhcp-events.rules
group:dnp3-events.rules
group:dns-events.rules
group:files.rules
group:ftp-events.rules
group:http2-events.rules
group:http-events.rules
group:ipsec-events.rules
group:kerberos-events.rules
group:modbus-events.rules
group:mqtt-events.rules
group:nfs-events.rules
group:ntp-events.rules
group:quic-events.rules
group:rfb-events.rules
group:smb-events.rules
group:smtp-events.rules
group:ssh-events.rules
group:stream-events.rules
group:tls-events.rules

```

The rules identified by the groups are commented out in the suricata.rules file and disabled.  
The rules identified by the sid’s are also commented out but not disabled.

---

<div class="post-metadata">

**Author:** ![Jeff\_Lucovsky](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/jeff_lucovsky/32/11_2.png) [@Jeff\_Lucovsky](https://forum.suricata.io/u/Jeff_Lucovsky)\
**Post date:** [March 15, 2024, 12:55pm UTC](https://forum.suricata.io/t/disable-rules-by-sid-not-working/4526/3 "2024-03-15T12:55:59Z")

</div>

Just to confirm – the rules that you wanted to be disabled are commented out in the rules file created by `suricata-update`?

Can you run and confirm that the rules file used by `suricata` is the one produced by `suricata-update`?

```auto
 $ suricata -c suricata.yaml --dump-config|grep -e default-rule-path -e rule-files
default-rule-path = /var/lib/suricata/rules
rule-files = (null)
rule-files.0 = suricata.rules

```

This shows that `suricata` will use `/var/lib/suricata/rules/suricata.rules`

---

<div class="post-metadata">

**Author:** ![gbL2k](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/gbl2k/32/2732_2.png) [@gbL2k](https://forum.suricata.io/u/gbL2k)\
**Post date:** [March 15, 2024, 1:00pm UTC](https://forum.suricata.io/t/disable-rules-by-sid-not-working/4526/4 "2024-03-15T13:00:34Z")

</div>

Yeah Its the same for me.  
Its strange because as I said when I grep for the sid in suricata.rules its commented out.

---

<div class="post-metadata">

**Author:** ![Jeff\_Lucovsky](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/jeff_lucovsky/32/11_2.png) [@Jeff\_Lucovsky](https://forum.suricata.io/u/Jeff_Lucovsky)\
**Post date:** [March 15, 2024, 1:02pm UTC](https://forum.suricata.io/t/disable-rules-by-sid-not-working/4526/5 "2024-03-15T13:02:00Z")

</div>

Suricata will ignore lines in the rules file that begin with `#` so I’m not sure why alerts appear for disabled rules.

---

<div class="post-metadata">

**Author:** ![sbhardwaj](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/sbhardwaj/32/10_2.png) [@sbhardwaj](https://forum.suricata.io/u/sbhardwaj)\
**Post date:** [March 15, 2024, 2:47pm UTC](https://forum.suricata.io/t/disable-rules-by-sid-not-working/4526/6 "2024-03-15T14:47:10Z")

</div>

Did you restart the engine or reload the rules after modifying them?