# Suricata Stops Collecting Data **URL:** \ **Category:** Help\ **Tags:** ips\ **Created:** [September 20, 2024, 2:53pm UTC](https://forum.suricata.io/t/suricata-stops-collecting-data/4861 "2024-09-20T14:53:47Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![epitaph91](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/epitaph91/32/3141_2.png) [@epitaph91](https://forum.suricata.io/u/epitaph91)\ **Post date:** [September 20, 2024, 2:53pm UTC](https://forum.suricata.io/t/suricata-stops-collecting-data/4861/1 "2024-09-20T14:53:48Z")
> Please include the following information with your help request: > > - Suricata version - 7.0.6 > - Operating system and/or Linux distribution - Ubuntu 24.04.1 LTS > - How you installed Suricata (from source, packages, something else) From source Issue: I updated to the latest version and during the update it got interrupted. Everything seem to be fine but after a couple hours Suricata stops collecting flow from the network interface and when i bounce the interface Suricata starts collecting data again. any help would be greatly appreciated. ---
**Author:** ![Jeff\_Lucovsky](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/jeff_lucovsky/32/11_2.png) [@Jeff\_Lucovsky](https://forum.suricata.io/u/Jeff_Lucovsky)\ **Post date:** [September 22, 2024, 12:39pm UTC](https://forum.suricata.io/t/suricata-stops-collecting-data/4861/2 "2024-09-22T12:39:23Z")
Without knowing what may have happened during the interrupted update, I’d start the process again and ensure it is completed w/out interruption. Then, see if the problem persists. If it does, it’s helpful to be more descriptive about what actually happened and supply relevant logs, what was expected vs what happened, the command line used to invoke Suricata, deployment mode (inline or ids), etc. ---
**Author:** ![epitaph91](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/epitaph91/32/3141_2.png) [@epitaph91](https://forum.suricata.io/u/epitaph91)\ **Post date:** [September 23, 2024, 2:14pm UTC](https://forum.suricata.io/t/suricata-stops-collecting-data/4861/3 "2024-09-23T14:14:32Z")
suricata.service - LSB: Next Generation IDS/IPS Loaded: loaded (/etc/init.d/suricata; generated) Active: active (running) since Tue 2024-09-17 16:56:52 EDT; 5 days ago Docs: man:systemd-sysv-generator(8) Process: 68531 ExecStart=/etc/init.d/suricata start (code=exited, status=0/SUCCESS) Tasks: 26 (limit: 308446) Memory: 1.4G (peak: 40.3G) CPU: 2d 14h 3min 5.225s CGroup: /system.slice/suricata.service └─68539 /usr/bin/suricata -c /etc/suricata/suricata.yaml --pidfile /var/run/suricata.pid --af-packet -D -vvv Sep 17 16:56:52 ubun-wazuh systemd[1]: Starting suricata.service - LSB: Next Generation IDS/IPS… Sep 17 16:56:52 ubun-wazuh suricata[68531]: Starting suricata in IDS (af-packet) mode… done. Sep 17 16:56:52 ubun-wazuh systemd[1]: Started suricata.service - LSB: Next Generation IDS/IPS. ---
**Author:** ![epitaph91](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/epitaph91/32/3141_2.png) [@epitaph91](https://forum.suricata.io/u/epitaph91)\ **Post date:** [September 23, 2024, 2:34pm UTC](https://forum.suricata.io/t/suricata-stops-collecting-data/4861/4 "2024-09-23T14:34:50Z")
I am not well versed in linux or suricata so what would you need for logs? I am aware of is using journalctl and /var/logs/suricata/suricata.stats. when i invoked the update i used sudo apt upgrade suricata The service appears to be running as you see from my previous reply using the systemctl status suricata when i run ip dev eno1 down then ip dev eno1 up it starts collecting and the mode is IDS ---
**Author:** ![epitaph91](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/epitaph91/32/3141_2.png) [@epitaph91](https://forum.suricata.io/u/epitaph91)\ **Post date:** [September 26, 2024, 12:29pm UTC](https://forum.suricata.io/t/suricata-stops-collecting-data/4861/5 "2024-09-26T12:29:32Z")
i may have found some interesting info… last log collection was at 09/25/2024-16:47:36.602320 Sep 25 14:03:21 ubun-wazuh kernel: ixgbe 0000:18:00.0: removed PHC on eno1 Sep 25 14:03:21 ubun-wazuh systemd-networkd[660]: eno1: Link DOWN Sep 25 14:03:21 ubun-wazuh systemd-networkd[660]: eno1: Lost carrier Sep 25 14:03:21 ubun-wazuh systemd-networkd[660]: eno1: DHCPv6 lease lost Sep 25 14:03:22 ubun-wazuh kernel: ixgbe 0000:18:00.0 eno1: left promiscuous mode Sep 25 14:03:23 ubun-wazuh kernel: ixgbe 0000:18:00.0: registered PHC device on eno1 Sep 25 14:03:23 ubun-wazuh systemd-networkd[660]: eno1: Link UP Sep 25 14:03:23 ubun-wazuh kernel: ixgbe 0000:18:00.0 eno1: entered promiscuous mode Sep 25 14:03:27 ubun-wazuh kernel: ixgbe 0000:18:00.0 eno1: NIC Link is Up 1 Gbps, Flow Control: RX Sep 25 14:03:27 ubun-wazuh systemd-networkd[660]: eno1: Gained carrier Sep 25 14:03:27 ubun-wazuh NetworkManager[1091]: [1727287407.3578] device (eno1): carrier: link connected Sep 25 14:03:28 ubun-wazuh systemd-networkd[660]: eno1: Gained IPv6LL ---
**Author:** ![epitaph91](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/epitaph91/32/3141_2.png) [@epitaph91](https://forum.suricata.io/u/epitaph91)\ **Post date:** [October 2, 2024, 12:05pm UTC](https://forum.suricata.io/t/suricata-stops-collecting-data/4861/6 "2024-10-02T12:05:04Z")
Hi Jeff were you able to see my other posts? Any help would be greatly appreciated. ---
**Author:** ![Jeff\_Lucovsky](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/jeff_lucovsky/32/11_2.png) [@Jeff\_Lucovsky](https://forum.suricata.io/u/Jeff_Lucovsky)\ **Post date:** [October 2, 2024, 12:16pm UTC](https://forum.suricata.io/t/suricata-stops-collecting-data/4861/7 "2024-10-02T12:16:46Z")
Can you locatel `suricata.log` on your system and post a snippet here (or DM the file to me)? ---
**Author:** ![epitaph91](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/epitaph91/32/3141_2.png) [@epitaph91](https://forum.suricata.io/u/epitaph91)\ **Post date:** [October 2, 2024, 8:11pm UTC](https://forum.suricata.io/t/suricata-stops-collecting-data/4861/8 "2024-10-02T20:11:00Z")
[suricata.log](https://forum.suricata.io/uploads/short-url/qSR2mLTkQKQ6r6glHwnWX6UGey6.log) (44.3 KB) attached. ---
**Author:** ![Jeff\_Lucovsky](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/jeff_lucovsky/32/11_2.png) [@Jeff\_Lucovsky](https://forum.suricata.io/u/Jeff_Lucovsky)\ **Post date:** [October 3, 2024, 1:37pm UTC](https://forum.suricata.io/t/suricata-stops-collecting-data/4861/9 "2024-10-03T13:37:00Z")
I’m not able to reproduce the issue using Suricata 7.0.7 on an ubuntu 24.04 system and AF\_PACKET. Your logs show that Suricata is receiving traffic when the interface is up and correctly detects and reacts to the interface goes offline and recovers. In your logs, the interface goes offline: ```auto [68628 - W#17-eno1] 2024-10-02 08:03:45 Warning: af-packet: eno1: failed to poll interface: Network is down ``` Then, the interface is back up a moment later: ```auto [68628 - W#17-eno1] 2024-10-02 08:03:48 Perf: af-packet: eno1: rx ring: block_size=32768 block_nr=6 frame_size=1600 frame_nr=120 ``` Suricata is terminated administratively: ```auto [68539 - Suricata-Main] 2024-10-02 08:11:10 Notice: suricata: Signal Received. Stopping engine. ``` Suricata logs this message when it detects the NIC isn’t online (there will be one log line for each writer thread): ```auto Warning: af-packet: enp23s0: failed to poll interface: Network is down [ReceiveAFPLoop:source-af-packet.c:1421] ``` When the interface comes back online and is detected by Suricata, you’ll see this pair of log notices (one for each worker thread): ```auto Info: af-packet: enp23s0: interface is back up [AFPTryReopen:source-af-packet.c:1302] Perf: af-packet: enp23s0: rx ring: block_size=32768 block_nr=7 frame_size=1600 frame_nr=140 [AFPComputeRingParams:source-af-packet.c:1601] ``` ---
**Author:** ![epitaph91](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/epitaph91/32/3141_2.png) [@epitaph91](https://forum.suricata.io/u/epitaph91)\ **Post date:** [October 3, 2024, 1:43pm UTC](https://forum.suricata.io/t/suricata-stops-collecting-data/4861/10 "2024-10-03T13:43:12Z")
i have just processed the successful update to 7.0.7 and it seems to be running without interruption thus far. i will repost after this weekend. Thank you, ---
**Author:** ![epitaph91](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/epitaph91/32/3141_2.png) [@epitaph91](https://forum.suricata.io/u/epitaph91)\ **Post date:** [October 7, 2024, 1:16pm UTC](https://forum.suricata.io/t/suricata-stops-collecting-data/4861/11 "2024-10-07T13:16:13Z")
It appears after i installed updated version 7.0.7 it seems to have resolved whatever was broken within the application and my collection has been consistant. thank you,