Suricata service failed to start

Installed suricata-5.0.0 in Centos but unable to start the service:
service fails to start with below error:

[root@ip-172-31-xx-xx :suricata-5.0.0]# sudo systemctl status -l suricata
● suricata.service - Suricata Intrusion Detection Service
Loaded: loaded (/usr/lib/systemd/system/suricata.service; disabled; vendor preset: disabled)
Active: failed (Result: exit-code) since Sat 2020-07-11 15:42:52 UTC; 1min 47s ago
Process: 31307 ExecStart=/sbin/suricata -c /usr/local/etc/suricata/suricata.yaml --pidfile /usr/local/var/run/suricata.pid $OPTIONS (code=exited, status=203/EXEC)
Process: 31304 ExecStartPre=/bin/rm -f /usr/local/var/run/suricata.pid (code=exited, status=0/SUCCESS)
Main PID: 31307 (code=exited, status=203/EXEC)

Jul 11 15:42:52 ip-172-31-xx-xx.us-east-2.compute.internal systemd[1]: Starting Suricata Intrusion Detection Service…

Jul 11 15:42:52 ip-172-31-xx-xx.us-east-2.compute.internal systemd[1]: Started Suricata Intrusion Detection Service.
Jul 11 15:42:52 ip-172-31-xx-xx.us-east-2.compute.internal systemd[1]: suricata.service: main process exited, code=exited, status=203/EXEC
Jul 11 15:42:52 ip-172-31-xx-xx.us-east-2.compute.internal systemd[1]: Unit suricata.service entered failed state.
Jul 11 15:42:52 ip-172-31-xx-xx.us-east-2.compute.internal systemd[1]: suricata.service failed.

I noticed that suricata.pid file is missing from /usr/local/var/run/.

What does /sbin/suricata -V give? Since the other paths are in /usr/local/ should the bin also be there?

Please make sure you use 5.0.3 btw, it fixes a large number of issues in 5.0.0.

Output is here:

[root@ip-172-31-xx-xx ~]# /sbin/suricata -V
bash: /sbin/suricata: No such file or directory

Can i copy bin folder to /usr/local/?

Locate where the suricata binary is installed with find / -name suricata.
Then, using the path reported from find, execute the path with -V

I couldn’t find /sbin/suricata path:
I got below list of results:

[root@ip-172-31-28-96 ~]# find / -name suricata
/etc/suricata
/var/log/suricata
/usr/bin/suricata
/usr/lib/python3.7/site-packages/suricata
/usr/share/doc/suricata
/usr/share/suricata
/usr/local/bin/suricata
/usr/local/etc/suricata
/usr/local/lib/python3.7/site-packages/suricata
/usr/local/share/suricata
/usr/local/share/doc/suricata
/usr/local/var/log/suricata
/usr/local/var/run/suricata
/root/suricata-5.0.0/src/suricata
/root/suricata-5.0.0/src/.libs/suricata
/root/suricata-5.0.0/python/suricata
/root/suricata-5.0.0/python/lib/suricata
/root/suricata-5.0.0/suricata-update/suricata

There’s 2 installs of suricata … one in /usr/local/ and on in the root.

Try /usr/bin/suricata -V and /usr/local/bin/suricata -V

[root@ip-172-31-xx-xx ~]# /usr/bin/suricata -V
This is Suricata version 5.0.0 RELEASE
[root@ip-172-31-xx-xx ~]# /usr/local/bin/suricata -V
This is Suricata version 5.0.0 RELEASE

Hello @ [Jeff Lucovsky],

Can you please suggest me what is the next step in order to fix this issue.

Please upgrade to Suricata 5.0.3 per @vjulien’s suggestion before trying anything else.

Before that please remove both existing installs to avoid conflicts and confusion later.

Sure thanks! I will comeback to you once i installed 5.0.3

Hello @vjulien /@Jeff_Lucovsky

I have freshly installed suricata-5.0.3: Post installation iam getting error:

[root@ip-172-31-xx-x suricata-5.0.3]# suricata -V
suricata: error while loading shared libraries: libhtp.so.2: cannot open shared object file: No such file or directory

It looks like you installed from source? You may need to add:

ldconfig /usr/local/lib

(alter depending on what you used for --prefix).

Installation successfull in 5.0.3, thanks for your support.