Suricata 6.0.0 opens twice

Help
1

With v6.0 suricata is now opened twice. It seems a stub is launched first then the main program. See below.

The problem with this is that the PID recorded the pid file is for the second invocation. Using that second PID with a “kill” command does not work; it is the first invocation’s PID that is required.

root      8564  0.1  0.1  17256  9012 pts/0    S    15:07   0:00  \_ /usr/bin/sudo /usr/local/bin/suricata -v --pidfile /d500g/var/run/suricata.pid -c /usr/local/etc/suricata/suricata.yaml -q 0
root      8569  100  2.8 248740 230800 pts/0   R    15:07   0:05      \_ /usr/local/bin/suricata -v --pidfile /d500g/var/run/suricata.pid -c /usr/local/etc/suricata/suricata.yaml -q 0
2

Never mind. Operator error.
I had the stop commands in a script and they were not grouped with quotation marks. So the kill command never saw the rest of the its commands.

3

This is normal with any command running under sudo… And it looks like you figured it out.