# Sshd service is getting restarted internally on starting Suricata **URL:** \ **Category:** Help\ **Tags:** community, centos, suricata\ **Created:** [July 24, 2024, 9:54am UTC](https://forum.suricata.io/t/sshd-service-is-getting-restarted-internally-on-starting-suricata/4771 "2024-07-24T09:54:34Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![malimahesh25](https://avatars.discourse-cdn.com/v4/letter/m/c89c15/32.png) [@malimahesh25](https://forum.suricata.io/u/malimahesh25)\ **Post date:** [July 24, 2024, 9:54am UTC](https://forum.suricata.io/t/sshd-service-is-getting-restarted-internally-on-starting-suricata/4771/1 "2024-07-24T09:54:34Z")
> I have tried 2 versions of Suricata: 7.0.0 and 7.0.6 > Operating system: almalinux 9.4 > I have installed Suricata from source. Whenever I start/restart Suricata service, it is restarting sshd service too. And I am loosing all the active SSH connections. Is this expected? Please assist me in fixing this problem. Thanks, Mahesh ---
**Author:** ![Andreas\_Herz](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/andreas_herz/32/52_2.png) [@Andreas\_Herz](https://forum.suricata.io/u/Andreas_Herz)\ **Post date:** [July 24, 2024, 10:25am UTC](https://forum.suricata.io/t/sshd-service-is-getting-restarted-internally-on-starting-suricata/4771/2 "2024-07-24T10:25:49Z")
Please provide more details, like the logs and also how you run Suricata (in which mode and run command), add `suricata.yaml` and check the `systemctl` state. How do you actually restart the Suricata service and how did you setup the sytemd file? ---
**Author:** ![malimahesh25](https://avatars.discourse-cdn.com/v4/letter/m/c89c15/32.png) [@malimahesh25](https://forum.suricata.io/u/malimahesh25)\ **Post date:** [July 24, 2024, 10:44am UTC](https://forum.suricata.io/t/sshd-service-is-getting-restarted-internally-on-starting-suricata/4771/3 "2024-07-24T10:44:00Z")
Hi @Andreas_Herz, Please find the attached yaml and service files. [suricata.yaml](https://forum.suricata.io/uploads/short-url/6MTsKOLHPwlWqAi5gMmWirMDIh9.yaml) (7.5 KB) [suricata.service.yaml](https://forum.suricata.io/uploads/short-url/iw3cZojM3s0889Kjj2oLxYWFRsW.yaml) (818 Bytes) Note: Added yaml extension for service file too as I was unable to upload the service file here. sshd is restarting on executing any of the below commands: systemctl start suricata systemctl restart suricata systemctl stop suricata ---
**Author:** ![Andreas\_Herz](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/andreas_herz/32/52_2.png) [@Andreas\_Herz](https://forum.suricata.io/u/Andreas_Herz)\ **Post date:** [July 24, 2024, 10:53am UTC](https://forum.suricata.io/t/sshd-service-is-getting-restarted-internally-on-starting-suricata/4771/4 "2024-07-24T10:53:17Z")
What is set for `$OPTIONS`, it looks like you run IPS mode, did you follow the guide at [15. Setting up IPS/inline for Linux — Suricata 8.0.0-dev documentation](https://docs.suricata.io/en/latest/setting-up-ipsinline-for-linux.html#setting-up-ips-with-netfilter) since I would guess it’s not an actual restart of the sshd but rather the iptables settings that “break” your connection. Also post the `suricata.log` and the logs from the services so we can see the actual messages. ---
**Author:** ![malimahesh25](https://avatars.discourse-cdn.com/v4/letter/m/c89c15/32.png) [@malimahesh25](https://forum.suricata.io/u/malimahesh25)\ **Post date:** [July 24, 2024, 12:03pm UTC](https://forum.suricata.io/t/sshd-service-is-getting-restarted-internally-on-starting-suricata/4771/5 "2024-07-24T12:03:59Z")
Thanks for checking the files @Andreas_Herz. I am attaching the suricata.log and system log files. The file has logs from the time for start and restart suricata operations.Please check. Thanks. [suricata.log](https://forum.suricata.io/uploads/short-url/j3NFHT2kU0wkP5Kg25XQk6NCRtB.log) (6.0 KB) [system.log](https://forum.suricata.io/uploads/short-url/jmDelt1TyikCTVBqMTvL4KapmHa.log) (6.7 KB) ---
**Author:** ![Dandy\_Islami\_Fikri](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/dandy_islami_fikri/32/3011_2.png) [@Dandy\_Islami\_Fikri](https://forum.suricata.io/u/Dandy_Islami_Fikri)\ **Post date:** [July 25, 2024, 5:28am UTC](https://forum.suricata.io/t/sshd-service-is-getting-restarted-internally-on-starting-suricata/4771/6 "2024-07-25T05:28:03Z")
same, I also can’t ssh after adding the service file and restarting it ---
**Author:** ![nostromo](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/nostromo/32/2983_2.png) [@nostromo](https://forum.suricata.io/u/nostromo)\ **Post date:** [July 26, 2024, 3:30pm UTC](https://forum.suricata.io/t/sshd-service-is-getting-restarted-internally-on-starting-suricata/4771/7 "2024-07-26T15:30:15Z")
Having a similar issue: [Suricata 7 dropping ssh sessions](https://forum.suricata.io/t/suricata-7-dropping-ssh-sessions/4757) ---
**Author:** ![Andreas\_Herz](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/andreas_herz/32/52_2.png) [@Andreas\_Herz](https://forum.suricata.io/u/Andreas_Herz)\ **Post date:** [July 26, 2024, 3:49pm UTC](https://forum.suricata.io/t/sshd-service-is-getting-restarted-internally-on-starting-suricata/4771/8 "2024-07-26T15:49:51Z")
Please also answer what are the values for `$OPTIONS` in your service file. Also 7.0.0 is a bit old, try to update to the most recent one. Keep in mind for IPS there are some changes from 6 to 7, see [4. Upgrading — Suricata 8.0.0-dev documentation](https://docs.suricata.io/en/latest/upgrade.html#upgrading-6-0-to-7-0) If you run IPS you need to make sure that you properly set the netfilter config, so that if Suricata stops for some reason packets are still processed (if that’s what you want)