Please include the following information with your help request:
- Suricata version
- Operating system and/or Linux distribution
- How you installed Suricata (from source, packages, something else)
Suricata version: 7.0.11 RELEASE
Operating system and/or Linux distribution: RHEL 9
How you installed Suricata: package (suricata.x86_64 —– 7.0.11-1.el9 —– @epel)
__________________________________________________________________________________
I have 2 interfaces on my VM (RHEL 9) and at any given time only one interface will have traffic. We have implemented 2 interfaces for HA. But I need to configure both ports in Suricata configurations. Whatever comes default after I install suricata.x86_64 is kept as it is and I make only required changes.
As per my understanding I have to edit two files
- suricata.yaml (/etc/suricata/suricata.yaml)
- /etc/sysconfig/suricata (env file for passing $OPTION arg while running service file at /usr/lib/systemd/system/suricata.service)
I am putting below configurations from each file
suricata.yaml ( I have removed comments and kept only options we are using)
af-packet:
- interface: ens224
threads: auto
cluster-id: 99
cluster-type: cluster_flow
defrag: yes
- interface: ens256
threads: auto
cluster-id: 99
cluster-type: cluster_flow
defrag: yes
Environment file- /etc/sysconfig/suricata
# The following parameters are the most commonly needed to configure
# suricata. A full list can be seen by running /sbin/suricata --help
# -i <network interface device>
# --user <acct name>
# --group <group name>
# Add options to be passed to the daemon
OPTIONS="-i ens224 -i ens256 -D "
Service file- /usr/lib/systemd/system/suricata.service
# Sample Suricata systemd unit file.
[Unit]
Description=Suricata Intrusion Detection Service
After=syslog.target network-online.target systemd-tmpfiles-setup.service
Documentation=man:suricata(1)
[Service]
# Environment file to pick up $OPTIONS. On Fedora/EL this would be
# /etc/sysconfig/suricata, or on Debian/Ubuntu, /etc/default/suricata.
EnvironmentFile=-/etc/sysconfig/suricata
#EnvironmentFile=-/etc/default/suricata
ExecStartPre=/bin/rm -f /var/run/suricata.pid
ExecStart=/sbin/suricata -c /etc/suricata/suricata.yaml --pidfile /var/run/suricata.pid $OPTIONS
ExecReload=/bin/kill -USR2 $MAINPID
### Security Settings ###
MemoryDenyWriteExecute=true
LockPersonality=true
ProtectControlGroups=true
ProtectKernelModules=true
[Install]
WantedBy=multi-user.target
Now after these configurations, I do
systemctl daemon-reload
systemctl restart suricata
systemctl status suricata
I get below status
● suricata.service - Suricata Intrusion Detection Service
Loaded: loaded (/usr/lib/systemd/system/suricata.service; enabled; preset: disabled)
Active: deactivating (stop-sigterm) since Mon 2025-09-29 19:25:55 HKT; 3s ago
Docs: man:suricata(1)
Process: 2357378 ExecStartPre=/bin/rm -f /var/run/suricata.pid (code=exited, status=0/SUCCESS)
Process: 2357380 ExecStart=/sbin/suricata -c /etc/suricata/suricata.yaml --pidfile /var/run/suricata.pid $OPTIONS (code=>
Main PID: 2357380 (code=exited, status=0/SUCCESS)
Tasks: 1 (limit: 100416)
Memory: 175.2M
CPU: 3.771s
CGroup: /system.slice/suricata.service
└─2357381 /sbin/suricata -c /etc/suricata/suricata.yaml --pidfile /var/run/suricata.pid -i ens224 -i ens256 -D
Sep 29 19:25:55 <VM_NAME> systemd[1]: Starting Suricata Intrusion Detection Service...
Sep 29 19:25:55 <VM_NAME> systemd[1]: Started Suricata Intrusion Detection Service.
Sep 29 19:25:55 <VM_NAME> suricata[2357380]: i: suricata: This is Suricata version 7.0.11 RELEASE running in SYSTEM mode
Sep 29 19:25:55 <VM_NAME> suricata[2357380]: E: af-packet: Problem with config file
See last line- suricata[2357380]: E: af-packet: Problem with config file
Can you please look into the configurations and let me know what I am missing here?