The ExecStart
is missing the -i
command line option. It should look like:
ExecStart=/usr/bin/suricata -c /etc/suricata/suricata.yaml -i eth0
If this is from a Suricata package that you installed I’d suggest reporting this back to whoever made the package.