# Suricata 8.0.7 "unknown rule keyword 'file.magic'

**URL:** <https://forum.suricata.io/t/suricata-8-0-7-unknown-rule-keyword-file-magic/6479>\
**Category:** Rules\
**Tags:** rules\
**Created:** [October 2, 2026, 7:04pm UTC](https://forum.suricata.io/t/suricata-8-0-7-unknown-rule-keyword-file-magic/6479 "2026-10-02T19:04:17Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![miltsiem](https://avatars.discourse-cdn.com/v4/letter/m/ecccb3/32.png) [@miltsiem](https://forum.suricata.io/u/miltsiem)\
**Post date:** [October 2, 2026, 7:04pm UTC](https://forum.suricata.io/t/suricata-8-0-7-unknown-rule-keyword-file-magic/6479/1 "2026-10-02T19:04:17Z")

</div>

Hi there! Please help.

I am new to Suricata and I installed Suricata 8.0.7 from source on Debian Trixie 13 and all folders are under /usr/local/…

I RTFM, actually sections of it to get Suricata installed and basically running. Interestingly when I cd into /usr/local/var/suricata and “ls” all I see are empty “certs” and “files” directories, no suricata.log? I setup a local user(not using root) with proper permissions to the needed directories.

**I run “suricata-update”:**  
– Using data-directory /usr/local/var/lib/suricata.  
2/10/2026 – 12:34:49 - – Using Suricata configuration /usr/local/etc/suricata/suricata.yaml  
2/10/2026 – 12:34:49 - – Using /usr/local/share/suricata/rules for Suricata provided rules.  
2/10/2026 – 12:34:49 - – Found Suricata version 8.0.7 at /usr/local/bin/suricata.  
2/10/2026 – 12:34:49 - – Loading /usr/local/etc/suricata/suricata.yaml

**I am using ET Open and receive msg loading distribution rule files about 20 of them:**

--Writing rules to /usr/local/var/lib/suricata/rules/suricata.rules: total: 69030; enabled: 53073; added: 77; removed 3; modified: 1322  
2/10/2026 – 12:35:03 - – Writing /usr/local/var/lib/suricata/rules/classification.config  
2/10/2026 – 12:35:03 - – Testing with suricata -T.

**Then I receive these error mgs about “file.magic”??**

-- unknown rule keyword ‘file.magic’.  
2/10/2026 – 12:35:04 - – error parsing signature “alert tcp any any → $HOME\_NET any (msg:“ET EXPLOIT 7-Zip 7z File PPMd Properties Parsing Integer Underflow (CVE-2023-31102)”; flow:established,to\_client; file.magic; content:“7-zip archive”; startswith; file.data; content:“7z|bc af 27 1c 00 30 00 00|”; startswith; fast\_pattern; pcre:”/\x30{24,}\x00\x30{24,}\x17\x06\x1a\x01/“; filesize:\<10000; reference:url, [Integer Overflow in 7zip (CVE-2023-31102) :: ds-security.com — A blog about IT-Security Research](http://ds-security.com/post/integer-overflow-in-7-zip-cve-2023-31102/) ; reference:cve,2023-31102; classtype:misc-attack; sid:2065690; rev:1; metadata:attack\_target Client\_Endpoint, created\_at 2025\_11\_06, cve CVE\_2023\_31102, deployment Perimeter, deployment Internal, confidence Low, signature\_severity Minor, tag Description\_Generated\_By\_Proofpoint\_Nexus, updated\_at 2025\_11\_06; target:dest\_ip;)” from file /usr/local/var/lib/suricata/rules/suricata.rules at line 12077

**I am receiving approx 9 – unknown rule keyword ‘file.magic’ errors?** The above example is related to an ET Exploit but the rest are related to "ET HUNTING Observed Zip Slip in TAR Archive or ZIP Archive.

**Then – Loading signatures failed.**  
2/10/2026 – 12:35:07 - – Suricata test failed, aborting.  
2/10/2026 – 12:35:07 - – Restoring previous rules.

**I ran the error msg through my local LLM for assistance:**

Summary:  
Suricata failed to load a security rule because it encountered an unsupported keyword: file.magic.

Key Details:

Error: The engine does not recognize file.magic as a valid instruction.  
Affected Rule: sid:2065690 (relating to a 7-Zip integer underflow exploit, CVE-2023-31102).  
Location: /usr/local/var/lib/suricata/rules/suricata.rules at line 12077.  
Impact: This specific rule is currently inactive and will not be monitored by the IDS.  
Cause:  
This usually happens because the rule was written for a different version of Suricata, contains a syntax error, or was intended for a different IDS engine (like Snort) that uses different naming conventions. To fix this, the file.magic; keyword needs to be removed or corrected to a supported Suricata command.

**Is the LLM correct? What am I doing wrong and what do you suggest to fix these “file.magic” errors?**

**Thank you**

---

<div class="post-metadata">

**Author:** ![Jeff\_Lucovsky](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/jeff_lucovsky/32/11_2.png) [@Jeff\_Lucovsky](https://forum.suricata.io/u/Jeff_Lucovsky)\
**Post date:** [October 3, 2026, 1:48pm UTC](https://forum.suricata.io/t/suricata-8-0-7-unknown-rule-keyword-file-magic/6479/2 "2026-10-03T13:48:28Z")

</div>

> [@miltsiem](#):
>
> suricata

The likely cause is that `libmagic` isn’t found and thus, the magic support cannot be used.

The output of `suricata --build-info` will show whether libmagic has been configured in the build; both must be true (libmagic must be found and suricata must be configured)

Here’s what my suricata build shows:

```auto
$ suricata --build-info|grep magic
  Libmagic support: yes

```

---

<div class="post-metadata">

**Author:** ![miltsiem](https://avatars.discourse-cdn.com/v4/letter/m/ecccb3/32.png) [@miltsiem](https://forum.suricata.io/u/miltsiem)\
**Post date:** [October 4, 2026, 7:56pm UTC](https://forum.suricata.io/t/suricata-8-0-7-unknown-rule-keyword-file-magic/6479/3 "2026-10-04T19:56:42Z")

</div>

Hi Jeff,

Thank you for your suggestion. “libmagic” was not installed. I installed the pkg and re-compiled suricata to pickup the changes. I no longer receive the errors from “unknown rule keyword ‘file.magic’.”