[errcode: sc_err_conf_yaml_error(242)]

Help
1

Hi All,

  • - [ERRCODE: SC_ERR_CONF_YAML_ERROR(242)] - Failed to parse configuration file at line 1248: found character that cannot start any token
    any solution?
2

Please attach your suricata.yaml so that it can be inspected.

1 Like
3

Hello,

I sometimes get that error when I inadvertently remove the first two lines or some portion of it:

%YAML 1.1
---
4

There’s been no activity on this subject for a while, but this is happening to me too. Thoughts?

2023-06-07T17:43:31-04:00 Warning suricata [100530] – [ERRCODE: SC_ERR_NO_RULES_LOADED(43)] - 2 rule files specified, but no rules were loaded!

2023-06-07T17:43:30-04:00 Warning suricata [100304] – [ERRCODE: SC_ERR_CONF_YAML_ERROR(242)] - App-Layer protocol http2 enable status not set, so enabling by default. This behavior will change in Suricata 7, so please update your config. See ticket #4744 for more details.
2023-06-07T17:43:30-04:00 Warning suricata [100304] – [ERRCODE: SC_ERR_CONF_YAML_ERROR(242)] - App-Layer protocol http2 enable status not set, so enabling by default. This behavior will change in Suricata 7, so please update your config. See ticket #4744 for more details.
2023-06-07T17:43:30-04:00 Warning suricata [100304] – [ERRCODE: SC_ERR_CONF_YAML_ERROR(242)] - App-Layer protocol rdp enable status not set, so enabling by default. This behavior will change in Suricata 7, so please update your config. See ticket #4744 for more details.
2023-06-07T17:43:30-04:00 Warning suricata [100304] – [ERRCODE: SC_ERR_CONF_YAML_ERROR(242)] - App-Layer protocol mqtt enable status not set, so enabling by default. This behavior will change in Suricata 7, so please update your config. See ticket #4744 for more details.
2023-06-07T17:43:30-04:00 Warning suricata [100304] – [ERRCODE: SC_ERR_CONF_YAML_ERROR(242)] - App-Layer protocol rfb enable status not set, so enabling by default. This behavior will change in Suricata 7, so please update your config. See ticket #4744 for more details.
2023-06-07T17:43:30-04:00 Warning suricata [100304] – [ERRCODE: SC_ERR_CONF_YAML_ERROR(242)] - App-Layer protocol sip enable status not set, so enabling by default. This behavior will change in Suricata 7, so please update your config. See ticket #4744 for more details.
5

Your issue is a little different than the original post, but the best way to answer your question would be sync your configuration file with the configuration file current for your Suricata version.

I’d start by updating to Suricata 6.0.12, the compare the default suricata.yaml with your running suricata.yaml, specifically the app-layer section, as there has most likely been new protocols added since your initial install. Sorry, its rather tedious I know.

The alternative would be start with a fresh default config and apply your modifications to that instead.

Hope that helps…