Suricata failed to start

Jan 08 15:36:47 robotpc systemd[1]: Started Suricata Intrusion Detection Service.
Jan 08 15:36:47 robotpc suricata[2969]: 8/1/2022 -- 15:36:47 - <Notice> - This is Suricata version 6.0.4 RELEASE running in SYSTEM mode
Jan 08 15:37:29 robotpc suricata[2969]: 8/1/2022 -- 15:37:29 - <Notice> - all 6 packet processing threads, 4 management threads initialized, >
Jan 08 15:37:38 robotpc systemd[1]: suricata.service: Main process exited, code=killed, status=11/SEGV
Jan 08 15:37:38 robotpc systemd[1]: suricata.service: Failed with result 'signal'.

what could be the culprit?

Could you run journalctl -u suricata so we can have more information?

-- Reboot --
Jan 08 15:06:01 robotpc systemd[1]: Starting Suricata Intrusion Detection Service...
Jan 08 15:06:01 robotpc systemd[1]: Started Suricata Intrusion Detection Service.
Jan 08 15:06:04 robotpc suricata[1270]: 8/1/2022 -- 15:06:04 - <Notice> - This is Suricata version 6.0.4 RELEASE running in SYSTEM mode
Jan 08 15:06:55 robotpc suricata[1270]: 8/1/2022 -- 15:06:55 - <Notice> - all 6 packet processing threads, 4 management threads initialized, >
Jan 08 15:09:24 robotpc systemd[1]: suricata.service: Main process exited, code=killed, status=11/SEGV
Jan 08 15:09:24 robotpc systemd[1]: suricata.service: Failed with result 'signal'.
Jan 08 15:17:44 robotpc systemd[1]: Starting Suricata Intrusion Detection Service...
Jan 08 15:17:44 robotpc systemd[1]: Started Suricata Intrusion Detection Service.
Jan 08 15:17:44 robotpc suricata[3362]: 8/1/2022 -- 15:17:44 - <Notice> - This is Suricata version 6.0.4 RELEASE running in SYSTEM mode
Jan 08 15:18:26 robotpc suricata[3362]: 8/1/2022 -- 15:18:26 - <Notice> - all 6 packet processing threads, 4 management threads initialized, >
Jan 08 15:26:24 robotpc suricata[3362]: 8/1/2022 -- 15:26:24 - <Notice> - Signal Received.  Stopping engine.
Jan 08 15:26:24 robotpc systemd[1]: Stopping Suricata Intrusion Detection Service...
Jan 08 15:26:25 robotpc suricata[3362]: 8/1/2022 -- 15:26:25 - <Notice> - (RX-NFQ#0) Treated: Pkts 0, Bytes 0, Errors 0
Jan 08 15:26:25 robotpc suricata[3362]: 8/1/2022 -- 15:26:25 - <Notice> - (RX-NFQ#0) Verdict: Accepted 0, Dropped 0, Replaced 0
Jan 08 15:26:26 robotpc systemd[1]: suricata.service: Succeeded.
Jan 08 15:26:26 robotpc systemd[1]: Stopped Suricata Intrusion Detection Service.
Jan 08 15:26:26 robotpc systemd[1]: Starting Suricata Intrusion Detection Service...
Jan 08 15:26:26 robotpc systemd[1]: Started Suricata Intrusion Detection Service.
Jan 08 15:26:26 robotpc suricata[3577]: 8/1/2022 -- 15:26:26 - <Notice> - This is Suricata version 6.0.4 RELEASE running in SYSTEM mode
Jan 08 15:26:38 robotpc systemd[1]: Stopping Suricata Intrusion Detection Service...
Jan 08 15:27:08 robotpc suricata[3577]: 8/1/2022 -- 15:27:08 - <Notice> - all 6 packet processing threads, 4 management threads initialized, >
Jan 08 15:27:08 robotpc suricata[3577]: 8/1/2022 -- 15:27:08 - <Notice> - Signal Received.  Stopping engine.
Jan 08 15:27:08 robotpc suricata[3577]: 8/1/2022 -- 15:27:08 - <Notice> - (RX-NFQ#0) Treated: Pkts 0, Bytes 0, Errors 0
Jan 08 15:27:08 robotpc suricata[3577]: 8/1/2022 -- 15:27:08 - <Notice> - (RX-NFQ#0) Verdict: Accepted 0, Dropped 0, Replaced 0
Jan 08 15:27:08 robotpc systemd[1]: suricata.service: Succeeded.
Jan 08 15:27:08 robotpc systemd[1]: Stopped Suricata Intrusion Detection Service.
Jan 08 15:27:08 robotpc systemd[1]: Starting Suricata Intrusion Detection Service...
Jan 08 15:27:08 robotpc systemd[1]: Started Suricata Intrusion Detection Service.
Jan 08 15:27:08 robotpc suricata[3620]: 8/1/2022 -- 15:27:08 - <Notice> - This is Suricata version 6.0.4 RELEASE running in SYSTEM mode
Jan 08 15:27:49 robotpc suricata[3620]: 8/1/2022 -- 15:27:49 - <Notice> - all 6 packet processing threads, 4 management threads initialized, >
Jan 08 15:28:36 robotpc systemd[1]: suricata.service: Main process exited, code=killed, status=11/SEGV
Jan 08 15:28:36 robotpc systemd[1]: suricata.service: Failed with result 'signal'.
-- Reboot --
Jan 08 15:31:13 robotpc systemd[1]: Started Suricata Intrusion Detection Service.
Jan 08 15:31:15 robotpc suricata[1347]: 8/1/2022 -- 15:31:15 - <Notice> - This is Suricata version 6.0.4 RELEASE running in SYSTEM mode
Jan 08 15:32:08 robotpc suricata[1347]: 8/1/2022 -- 15:32:08 - <Notice> - all 6 packet processing threads, 4 management threads initialized, >
Jan 08 15:34:06 robotpc systemd[1]: suricata.service: Main process exited, code=killed, status=11/SEGV
Jan 08 15:34:06 robotpc systemd[1]: suricata.service: Failed with result 'signal'.
Jan 08 15:36:47 robotpc systemd[1]: Started Suricata Intrusion Detection Service.
Jan 08 15:36:47 robotpc suricata[2969]: 8/1/2022 -- 15:36:47 - <Notice> - This is Suricata version 6.0.4 RELEASE running in SYSTEM mode
Jan 08 15:37:29 robotpc suricata[2969]: 8/1/2022 -- 15:37:29 - <Notice> - all 6 packet processing threads, 4 management threads initialized, >
Jan 08 15:37:38 robotpc systemd[1]: suricata.service: Main process exited, code=killed, status=11/SEGV
Jan 08 15:37:38 robotpc systemd[1]: suricata.service: Failed with result 'signal'.
Jan 08 16:00:15 robotpc systemd[1]: Started Suricata Intrusion Detection Service.
Jan 08 16:00:16 robotpc suricata[4523]: 8/1/2022 -- 16:00:16 - <Notice> - This is Suricata version 6.0.4 RELEASE running in SYSTEM mode
Jan 08 16:00:57 robotpc suricata[4523]: 8/1/2022 -- 16:00:57 - <Notice> - all 6 packet processing threads, 4 management threads initialized, >
Jan 08 16:01:36 robotpc systemd[1]: suricata.service: Main process exited, code=killed, status=11/SEGV
Jan 08 16:01:36 robotpc systemd[1]: suricata.service: Failed with result 'signal'.
Jan 08 16:05:08 robotpc systemd[1]: Started Suricata Intrusion Detection Service.
Jan 08 16:05:08 robotpc suricata[4926]: 8/1/2022 -- 16:05:08 - <Notice> - This is Suricata version 6.0.4 RELEASE running in SYSTEM mode
Jan 08 16:05:49 robotpc suricata[4926]: 8/1/2022 -- 16:05:49 - <Notice> - all 6 packet processing threads, 4 management threads initialized, >
Jan 08 16:06:56 robotpc systemd[1]: suricata.service: Main process exited, code=killed, status=11/SEGV
Jan 08 16:06:56 robotpc systemd[1]: suricata.service: Failed with result 'signal'.
Jan 08 16:08:42 robotpc systemd[1]: Started Suricata Intrusion Detection Service.
Jan 08 16:08:43 robotpc suricata[5071]: 8/1/2022 -- 16:08:43 - <Notice> - This is Suricata version 6.0.4 RELEASE running in SYSTEM mode
Jan 08 16:09:24 robotpc suricata[5071]: 8/1/2022 -- 16:09:24 - <Notice> - all 6 packet processing threads, 4 management threads initialized, >
Jan 08 16:09:46 robotpc systemd[1]: suricata.service: Main process exited, code=killed, status=11/SEGV
Jan 08 16:09:46 robotpc systemd[1]: suricata.service: Failed with result 'signal'.
-- Reboot --
Jan 09 14:51:11 robotpc systemd[1]: Starting Suricata Intrusion Detection Service...
Jan 09 14:51:11 robotpc systemd[1]: Started Suricata Intrusion Detection Service.
Jan 09 14:51:12 robotpc suricata[4451]: 9/1/2022 -- 14:51:12 - <Notice> - This is Suricata version 6.0.4 RELEASE running in SYSTEM mode
Jan 09 14:51:57 robotpc suricata[4451]: 9/1/2022 -- 14:51:57 - <Notice> - all 6 packet processing threads, 4 management threads initialized, >
Jan 09 15:19:20 robotpc systemd[1]: suricata.service: Main process exited, code=killed, status=11/SEGV
Jan 09 15:19:20 robotpc systemd[1]: suricata.service: Failed with result 'signal'.
root@robotpc:/home/admin-one/Desktop/ubuntu-setup/8-iptables# 


systemd file

[Unit]
Description=Suricata Intrusion Detection Service
After=syslog.target network-online.target systemd-tmpfiles-setup.service
Documentation=man:suricata(1)

[Service]
# Environment file to pick up $OPTIONS. On Fedora/EL this would be
# /etc/sysconfig/suricata, or on Debian/Ubuntu, /etc/default/suricata.
#EnvironmentFile=-/etc/sysconfig/suricata
EnvironmentFile=-/etc/default/suricata
ExecStartPre=/bin/rm -f /var/run/suricata.pid
ExecStart=/usr/bin/suricata -c /etc/suricata/suricata.yaml -q 0 --pidfile /var/run/suricata.pid $OPTIONS
ExecReload=/bin/kill -USR2 $MAINPID

### Security Settings ###
MemoryDenyWriteExecute=true
LockPersonality=true
ProtectControlGroups=true
ProtectKernelModules=true

[Install]
WantedBy=multi-user.target

on ubuntu - Linux 5.11.0-27-generic #29~20.04.1-Ubuntu
Suricata version 6.0.4 RELEASE

Can you locate the core dump produced by Suricata? If so, having a stack trace would be quite helpful.

If you can find the core dump, then
gdb suricata /path/to/core.file
then, when you get the Suricata prompt

(gdb) bt full
1 Like