Error when running 4.1.8 but not 5.0.3

Help
1

Hi,
I’ve been testing 4.1.8 for use in a system, and every time I go to run it I get the following warning.

- [ERRCODE: SC_WARN_NO_STATS_LOGGERS(261)] - stats are enabled but no loggers are active

I set stats to be disabled in the yaml file, and on the command line, and I still get the error.

I built 5.0.3 just to verify against, and when using the same yaml file, I do not get the error.

I would like to eventually move to 5.0.3, but I currently don’t have that option.
Any help would be appreciated.

2

Can you post your suricata.yaml file?

3

suricata.yaml (48.6 KB)

Here’s my current copy

4 
 diff ~/new.yaml ~/suri_4.1.8.yaml
76c76
<   enabled: no
---
>   enabled: yes
225c225
<       enabled: no
---
>       enabled: yes
5

Sorry, I’m not sure I understand your last comment.
I want stats to be disabled, and stats are set to
enabled: no
in the yaml file. Even with it disabled, I get a warning saying stats are enabled.

Using the same yaml file I posted with 5.0.3, I don’t get the warning.

6

Sorry – I reversed the sense of your question.

The message is incorrectly logged and as you noticed, it’s fixed in future versions.

4.1.8 will be EOL soon so upgrading to 5.0.3 should be planned for.

7

No problem, thanks for the responses.
And yeah, we are planning on upgrading to 5.0.3, just didn’t have the option right now.
Thanks again.