Suricata is not working as expected in Windows server

Help
1

Hi,

We have downloaded and installed latest package from the portal. But is not working. Please refer to the below error and advise further action.

C:\Program Files\Suricata>suricata.exe -c suricata.yaml -s signatures.rules -i eth0

29/8/2022 – 17:50:26 - - Running as service: no

29/8/2022 – 17:50:26 - - Configuration node ‘HOME_NET’ redefined.

29/8/2022 – 17:50:26 - - Configuration node ‘HOME_NET’ redefined.

29/8/2022 – 17:50:26 - - Configuration node ‘HOME_NET’ redefined.

29/8/2022 – 17:50:26 - - Configuration node ‘HOME_NET’ redefined.

29/8/2022 – 17:50:26 - - Configuration node ‘EXTERNAL_NET’ redefined.

Error opening file /var/log/suricata//suricata.log

29/8/2022 – 17:50:27 - - This is Suricata version 6.0.6 RELEASE running in SYSTEM mode

29/8/2022 – 17:50:27 - - [ERRCODE: SC_ERR_CONF_YAML_ERROR(242)] - App-Layer protocol sip enable status not set, so enabling by default. This behavior will change in Suricata 7, so please update your config. See ticket #4744 for more details.

29/8/2022 – 17:50:27 - - [ERRCODE: SC_ERR_CONF_YAML_ERROR(242)] - App-Layer protocol mqtt enable status not set, so enabling by default. This behavior will change in Suricata 7, so please update your config. See ticket #4744 for more details.

29/8/2022 – 17:50:27 - - [ERRCODE: SC_ERR_CONF_YAML_ERROR(242)] - App-Layer protocol rdp enable status not set, so enabling by default. This behavior will change in Suricata 7, so please update your config. See ticket #4744 for more details.

C:\Program Files\Suricata>

2

In the suricata.yaml file you should change the path to the log file.

As seen in your trace:

Error opening file /var/log/suricata//suricata.log

Is not a valid path for a windows system.