/etc/suricata/disable.conf and checksum

[ish (Jason Ish)]

@AndSimp

I thought that if I add this to disable.conf it would disable the alerts about these rules into the log file. Sadly its not working.
If i # the rules in decoderevents.rules its working, but i wanted to do this in a separate file as it was written in the doc above with the disable.conf.

Am I missing something or is disable.conf not working at all or did I write something that is not ok in the file? I did as the doc suggested update/restart and it wrote it loaded the disable.conf:
– Loading /etc/suricata/disable.conf.
with no error, so it should be fine?

Can you tell us what the rule-files section of your suricata.yaml looks like? It looks like its loading the rule files directly, if it works when you comment it out. So Suricata might not be loading the output of suricata-update, which is most likely in /var/lib/suricata/rules.