Suricata service failed to start

Help
1

Installed suricata-5.0.0 in Centos but unable to start the service:
service fails to start with below error:

[root@ip-172-31-xx-xx :suricata-5.0.0]# sudo systemctl status -l suricata
● suricata.service - Suricata Intrusion Detection Service
Loaded: loaded (/usr/lib/systemd/system/suricata.service; disabled; vendor preset: disabled)
Active: failed (Result: exit-code) since Sat 2020-07-11 15:42:52 UTC; 1min 47s ago
Process: 31307 ExecStart=/sbin/suricata -c /usr/local/etc/suricata/suricata.yaml --pidfile /usr/local/var/run/suricata.pid $OPTIONS (code=exited, status=203/EXEC)
Process: 31304 ExecStartPre=/bin/rm -f /usr/local/var/run/suricata.pid (code=exited, status=0/SUCCESS)
Main PID: 31307 (code=exited, status=203/EXEC)

Jul 11 15:42:52 ip-172-31-xx-xx.us-east-2.compute.internal systemd[1]: Starting Suricata Intrusion Detection Service…

Jul 11 15:42:52 ip-172-31-xx-xx.us-east-2.compute.internal systemd[1]: Started Suricata Intrusion Detection Service.
Jul 11 15:42:52 ip-172-31-xx-xx.us-east-2.compute.internal systemd[1]: suricata.service: main process exited, code=exited, status=203/EXEC
Jul 11 15:42:52 ip-172-31-xx-xx.us-east-2.compute.internal systemd[1]: Unit suricata.service entered failed state.
Jul 11 15:42:52 ip-172-31-xx-xx.us-east-2.compute.internal systemd[1]: suricata.service failed.

I noticed that suricata.pid file is missing from /usr/local/var/run/.

2

What does /sbin/suricata -V give? Since the other paths are in /usr/local/ should the bin also be there?

Please make sure you use 5.0.3 btw, it fixes a large number of issues in 5.0.0.

1 Like
3

Output is here:

[root@ip-172-31-xx-xx ~]# /sbin/suricata -V
bash: /sbin/suricata: No such file or directory

4

Can i copy bin folder to /usr/local/?

5

Locate where the suricata binary is installed with find / -name suricata.
Then, using the path reported from find, execute the path with -V

1 Like
6

I couldn’t find /sbin/suricata path:
I got below list of results:

[root@ip-172-31-28-96 ~]# find / -name suricata
/etc/suricata
/var/log/suricata
/usr/bin/suricata
/usr/lib/python3.7/site-packages/suricata
/usr/share/doc/suricata
/usr/share/suricata
/usr/local/bin/suricata
/usr/local/etc/suricata
/usr/local/lib/python3.7/site-packages/suricata
/usr/local/share/suricata
/usr/local/share/doc/suricata
/usr/local/var/log/suricata
/usr/local/var/run/suricata
/root/suricata-5.0.0/src/suricata
/root/suricata-5.0.0/src/.libs/suricata
/root/suricata-5.0.0/python/suricata
/root/suricata-5.0.0/python/lib/suricata
/root/suricata-5.0.0/suricata-update/suricata

7

There’s 2 installs of suricata … one in /usr/local/ and on in the root.

Try /usr/bin/suricata -V and /usr/local/bin/suricata -V

9

[root@ip-172-31-xx-xx ~]# /usr/bin/suricata -V
This is Suricata version 5.0.0 RELEASE
[root@ip-172-31-xx-xx ~]# /usr/local/bin/suricata -V
This is Suricata version 5.0.0 RELEASE

10

Hello @ [Jeff Lucovsky],

Can you please suggest me what is the next step in order to fix this issue.

11

Please upgrade to Suricata 5.0.3 per @vjulien’s suggestion before trying anything else.

12

Before that please remove both existing installs to avoid conflicts and confusion later.

13

Sure thanks! I will comeback to you once i installed 5.0.3

14

Hello @vjulien /@Jeff_Lucovsky

I have freshly installed suricata-5.0.3: Post installation iam getting error:

[root@ip-172-31-xx-x suricata-5.0.3]# suricata -V
suricata: error while loading shared libraries: libhtp.so.2: cannot open shared object file: No such file or directory

15

It looks like you installed from source? You may need to add:

ldconfig /usr/local/lib

(alter depending on what you used for --prefix).

16

Installation successfull in 5.0.3, thanks for your support.

17

Dear people

I see this error:
ExecStart=/usr/bin/suricata -c /etc/suricata/suricata.yaml $OPTIONS (code=exited, status=1/FAILURE)

I have suricata version 4 and after some changes this happened.

How could I resolve it?

18

Hello there,

When you mention some changes, what kind of changes were those?

I’d like to add: if possible, it is highly recommended that you update your Suricata, as Suricata 4 hasn’t been supported for a while.

19

Dear Ju,

We have a power outage in data center and after that PCI NIC that was capturing traffic damaged and I switched to onboard NIC and changed the linux interface settings and suricata.yaml but cannot start suricata yet.

How can I start troubleshooting?

Thank you very much

20

Hello, do you see any other error output?

This is not my area of expertise, but I’d try to see if there’s any more info to understand the situation.

You could also try sharing your setup and configuration here.

And, if possible, I would highly recommend that you updated your Suricata version, as 4 hasn’t been supported for a long while…

21

Dear Ju

I loaded pf_ring.ko with insmod and the problem solved.

1 Like