# Suricata exits with errors when running with -r and --pcap-file-continuous **URL:** \ **Category:** Help\ **Tags:** suricata, pcaps\ **Created:** [January 17, 2024, 4:34pm UTC](https://forum.suricata.io/t/suricata-exits-with-errors-when-running-with-r-and-pcap-file-continuous/4396 "2024-01-17T16:34:45Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![alessandro.pernafini](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/alessandro.pernafini/32/2619_2.png) [@alessandro.pernafini](https://forum.suricata.io/u/alessandro.pernafini)\ **Post date:** [January 17, 2024, 4:34pm UTC](https://forum.suricata.io/t/suricata-exits-with-errors-when-running-with-r-and-pcap-file-continuous/4396/1 "2024-01-17T16:34:45Z")
Hello, I would like to let Suricata analyze pcap files created by another tool on a local folder. When I use the command ```auto suricata -c /etc/suricata/suricata.yaml -r ~/pcaps --pcap-file-continuous --pcap-file-delete -vvv ``` Suricata starts scanning the folder, but after a couple of seconds it crashes with the following message: > Error: threads: thread “FM#01” failed to start in time: flags 0003 [TmThreadWaitOnThreadRunning:tm-threads.c:1830] I’m running Ubuntu 22.04 and I’ve tried both version 7.0.2 from Ubuntu repositories and version 8.0.0-dev compiled from source, but the result it’s the same. If I remove the --pcap-file-continuous option from the command, Suricata scans the directory once, evaluates the pcaps inside that dir and exits without any error, so I think that the problem could be related to that option. The only workaround I foud so far is to make a cronjob to schedule Suricata to perform a single scan of the pcap folder, but I would like to have a more reliable solution. Can you give me any hint? Thanks! ---
**Author:** ![lukashino](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/lukashino/32/1150_2.png) [@lukashino](https://forum.suricata.io/u/lukashino)\ **Post date:** [January 18, 2024, 7:13pm UTC](https://forum.suricata.io/t/suricata-exits-with-errors-when-running-with-r-and-pcap-file-continuous/4396/2 "2024-01-18T19:13:20Z")
Hi Alessandro, welcome! I’ve tried to replicate your setup: ```auto suricata -r /tmp/pcaps/ --pcap-file-continuous --pcap-file-delete -vvvv ``` and, indeed, on Suri 7.0.2, I get the same result: ```auto Info: pcap: Processing pcaps directory /tmp/pcaps/, files must be newer than 0 and older than 1705604840362 [PcapDirectoryDispatch:source-pcap-file-directory-helper.c:497] Info: pcap: Processing pcaps directory /tmp/pcaps/, files must be newer than 0 and older than 1705604845362 [PcapDirectoryDispatch:source-pcap-file-directory-helper.c:497] Info: pcap: Processing pcaps directory /tmp/pcaps/, files must be newer than 0 and older than 1705604850363 [PcapDirectoryDispatch:source-pcap-file-directory-helper.c:497] Error: threads: thread "FM#01" failed to start in time: flags 0003 [TmThreadWaitOnThreadRunning:tm-threads.c:1832] ``` I’ll let others make the judgement but indeed it looks like a bug that we’ll need to take care of. Thanks for reporting that. ---
**Author:** ![alessandro.pernafini](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/alessandro.pernafini/32/2619_2.png) [@alessandro.pernafini](https://forum.suricata.io/u/alessandro.pernafini)\ **Post date:** [January 19, 2024, 9:36am UTC](https://forum.suricata.io/t/suricata-exits-with-errors-when-running-with-r-and-pcap-file-continuous/4396/3 "2024-01-19T09:36:07Z")
Hi Lukas, thanks for your reply. Yesterday I made some further tests; I started Suricata making it listen on a Unix socket with the following command: ```auto suricata -c ~/suricata_tests/suricata.yaml -l ~/suricata_tests/logs --unix-socket=custom.socket -vvvv ``` After that, I used suricatasc to connect to the Unix socket and I sent the command: ```auto pcap-file-continuous /home/st5/pcaps . ``` Suricata then started polling the directory for pcap files without crashing. Hence, I think that the problem could be related to the bootstrap procedure when using the **–pcap-file-continuous** parameter. Hope that this can help in finding a solution to a possible bug. ---
**Author:** ![oferdagan](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/oferdagan/32/3163_2.png) [@oferdagan](https://forum.suricata.io/u/oferdagan)\ **Post date:** [January 15, 2025, 7:10am UTC](https://forum.suricata.io/t/suricata-exits-with-errors-when-running-with-r-and-pcap-file-continuous/4396/4 "2025-01-15T07:10:07Z")
Hi, Is there an update on this bug? Was this fixed in a later version of suricata? Thanks ---
**Author:** ![lukashino](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/lukashino/32/1150_2.png) [@lukashino](https://forum.suricata.io/u/lukashino)\ **Post date:** [February 22, 2025, 6:50pm UTC](https://forum.suricata.io/t/suricata-exits-with-errors-when-running-with-r-and-pcap-file-continuous/4396/5 "2025-02-22T18:50:11Z")
Hi Ofer, The directory needs to have at least one pcap for Suricata to start with then it runs fine. ---
**Author:** ![oferdagan](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/oferdagan/32/3163_2.png) [@oferdagan](https://forum.suricata.io/u/oferdagan)\ **Post date:** [March 13, 2025, 10:52am UTC](https://forum.suricata.io/t/suricata-exits-with-errors-when-running-with-r-and-pcap-file-continuous/4396/6 "2025-03-13T10:52:04Z")
Hi, Thanks for the response 🙂 Isn’t it a bug? In my use case I’m setting up suricata and feeding it files, but it might start empty. Should I add a “dummy pcap”? ---
**Author:** ![lukashino](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/lukashino/32/1150_2.png) [@lukashino](https://forum.suricata.io/u/lukashino)\ **Post date:** [March 19, 2025, 3:49am UTC](https://forum.suricata.io/t/suricata-exits-with-errors-when-running-with-r-and-pcap-file-continuous/4396/7 "2025-03-19T03:49:34Z")
yes, it is a bug, I’ve filed to a ticket and will start looking it. > **[Bug #7568: pcap: continuous file reading fails on an empty directory -...](https://redmine.openinfosecfoundation.org/issues/7568)** > > Redmine for now, if you can add a dummy pcap before the start of Suricata that would “fix” it.