Failed: suricata.service - Suricata IDS/IDP daemon

Hi All, I need help.

OS :Yocto (Dunfell +QT5)
Device:Nitrogen8m

When I run the command " systemctl status suricata.service" getting this failed status

Is this related to " [errcode: sc_warn_flowbit(306)]"

Can you also post the suricata.service file?

Hi,

I cant find the suricata.service

image

Suricata.yaml file

suricata.yaml (73.3 KB)

From you screenshot above it looks like it should be /lib/systemd/system/suricata.service.

Thank You, I find the file at /lib/systemd/system/suricata.service.

The ExecStart is missing the -i command line option. It should look like:

ExecStart=/usr/bin/suricata -c /etc/suricata/suricata.yaml -i eth0

If this is from a Suricata package that you installed I’d suggest reporting this back to whoever made the package.

Hi,
I changed the ExecStart=/usr/bin/suricata -c /etc/suricata/suricata.yaml eth0 —> ExecStart=/usr/bin/suricata -c /etc/suricata/suricata.yaml -i eth0

Now its showing, “Active (Running)”, Please confirm that

I taken this recipe from" OpenEmbedded Layer Index - suricata "and bitbaked in to Yocto(dunfell +QT5) image

Looks like its running now.

You didn’t specify a version, but I don’t think you should see those warnings with an update to date Suricata 6.0 or 5.0 release and up to date rules.

That documentation is out of date and exists for reference purposes only. Please see the the current documtation linked at the top of the page, or more specifically 7. Rule Management — Suricata 6.0.4 documentation.

Thank you, I will look into it.
I will get back to you once it got resolved.