Some error Suricata 8 installation

Developers
1

Hi guys! , I’m doing a clean install of Suricata 8 on Ubuntu 22.04 and when I look at the logs, it shows me that there are directories that were not created.

Starting Suricata IDS/IPS/NSM/FW daemon…
Jul 18 15:12:57 sensor systemd[1]: Started Suricata IDS/IPS/NSM/FW daemon.
Jul 18 15:12:57 sensor suricata[2673]: i: suricata: This is Suricata version 8.0.0 RELEASE running in SYSTEM mode
Jul 18 15:12:57 sensor suricata[2673]: E: pidfile: unable to set pidfile ‘/run/suricata.pid’: Permission denied
Jul 18 15:12:57 sensor suricata[2673]: E: suricata: Unable to create PID file, concurrent run of Suricata can occur.
Jul 18 15:12:57 sensor suricata[2673]: E: suricata: PID file creation WILL be mandatory for daemon mode in future version
Jul 18 15:13:23 sensor suricata[2673]: i: mpm-hs: Rule group caching - loaded: 108 newly cached: 0 total cacheable: 108
Jul 18 15:13:23 sensor suricata[2673]: E: unix-manager: failed to create socket directory /var/run/suricata/: Permission denied
Jul 18 15:13:23 sensor suricata[2673]: W: unix-manager: Unable to create unix command socket
Jul 18 15:13:24 sensor suricata[2673]: i: threads: Threads created → W: 2 FM: 1 FR: 1 Engine started.

mkdir -p /var/run/suricata
chown -R suricata:suricata /var/run/suricata/

I restart Suricata again and it says the process cannot be created.

Jul 18 15:36:29 sensor suricata[4231]: E: pidfile: unable to set pidfile ‘/run/suricata.pid’: Permission denied
Jul 18 15:36:29 sensor suricata[4231]: E: suricata: Unable to create PID file, concurrent run of Suricata can occur.
Jul 18 15:36:29 sensor suricata[4231]: E: suricata: PID file creation WILL be mandatory for daemon mode in future version

remove the comment inside of Suricata.yaml

pid-file: /var/run/suricata/suricata.pid

It doesn’t work either

2

Can you paste the output of sudo service suricata status?

3 
sudo service suricata status
● suricata.service - Suricata IDS/IPS/NSM/FW daemon
     Loaded: loaded (/lib/systemd/system/suricata.service; enabled; vendor preset: enabled)
     Active: active (running) since Sat 2025-07-19 13:27:16 CST; 5s ago
       Docs: man:suricata(8)
             man:suricatasc(8)
             https://suricata.io/documentation/
    Process: 3123 ExecStartPre=/bin/rm -f /run/suricata.pid (code=exited, status=0/SUCCESS)
   Main PID: 3124 (Suricata-Main)
      Tasks: 1 (limit: 6970)
     Memory: 190.5M
        CPU: 5.271s
     CGroup: /system.slice/suricata.service
             └─3124 /usr/bin/suricata --af-packet -c /etc/suricata/suricata.yaml --pidfile /run/suricata.pid

Jul 19 13:27:16 sensor systemd[1]: Starting Suricata IDS/IPS/NSM/FW daemon...
Jul 19 13:27:16 sensor systemd[1]: Started Suricata IDS/IPS/NSM/FW daemon.
Jul 19 13:27:16 sensor suricata[3124]: i: suricata: This is Suricata version 8.0.0 RELEASE running in SYSTEM mode
Jul 19 13:27:16 sensor suricata[3124]: E: pidfile: unable to set pidfile '/run/suricata.pid': Permission denied
Jul 19 13:27:16 sensor suricata[3124]: E: suricata: Unable to create PID file, concurrent run of Suricata can occur.
Jul 19 13:27:16 sensor suricata[3124]: E: suricata: PID file creation WILL be mandatory for daemon mode in future version
4

Hi Rick,m
It seems Suricata is up and running base don the service status output - however , lets check a few things if you dont mind.

Which package are you running ? It should be form one of those repos : suricata-stable : OISF or suricata-8.0 : OISF

What is the output of : dpkg -l | grep suricata

Thank you