# Suricata-Update and custom signature sets **URL:** \ **Category:** Rules\ **Created:** [June 30, 2020, 3:52pm UTC](https://forum.suricata.io/t/suricata-update-and-custom-signature-sets/381 "2020-06-30T15:52:14Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![netsecuris1](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/netsecuris1/32/89_2.png) [@netsecuris1](https://forum.suricata.io/u/netsecuris1)\ **Post date:** [June 30, 2020, 3:52pm UTC](https://forum.suricata.io/t/suricata-update-and-custom-signature-sets/381/1 "2020-06-30T15:52:14Z")
If I am using Suricata-Update for ET PRO rules, how do I handle custom signatures? I listed the custom signature set file name in addition to suricata.rules in suricata.yaml then I put the custom file in /var/lib/suricata/rules/. Do I need to do anything else to get the custom rule set file to work with suricata along with suricata.rules too? ---
**Author:** ![sbhardwaj](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/sbhardwaj/32/10_2.png) [@sbhardwaj](https://forum.suricata.io/u/sbhardwaj)\ **Post date:** [July 2, 2020, 2:53pm UTC](https://forum.suricata.io/t/suricata-update-and-custom-signature-sets/381/2 "2020-07-02T14:53:23Z")
Hi Leonard! Does your configuration look like the following? ```auto default-rule-path: /var/lib/suricata/rules rule-files: - suricata.rules - myrules.rules # this is the name of the file you put in /var/lib/suricata/rules ``` ---
**Author:** ![netsecuris1](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/netsecuris1/32/89_2.png) [@netsecuris1](https://forum.suricata.io/u/netsecuris1)\ **Post date:** [July 2, 2020, 3:01pm UTC](https://forum.suricata.io/t/suricata-update-and-custom-signature-sets/381/3 "2020-07-02T15:01:20Z")
Yes. The second custom rule set should be firing but I see no alerts from it. It works in version 4 of suricata. Leonard Jacobs, MS, MBA, CISSP, CSSA President/CEO Netsecuris LLC Office (662) 667-7796 [http://www.netsecuris.com](http://www.netsecuris.com) Netsecuris is proud to be listed in MSSP Alert’s 2019 Top 200 MSSP List, ChannelE2E’s Top 100 Vertical Market MSPs List for 2019, and The Channel Company’s 2019 list of Top 100 Cyber Security Services Providers. ---
**Author:** ![sbhardwaj](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/sbhardwaj/32/10_2.png) [@sbhardwaj](https://forum.suricata.io/u/sbhardwaj)\ **Post date:** [July 2, 2020, 3:05pm UTC](https://forum.suricata.io/t/suricata-update-and-custom-signature-sets/381/4 "2020-07-02T15:05:24Z")
Alert firing might be due to something else but your rule file should be getting loaded. Could you please confirm if you see ```auto 2/7/2020 -- 20:33:55 - - Loading rule file: /var/lib/suricata/rules/myrules.rules 2/7/2020 -- 20:33:55 - - No rules loaded from myrules.rules. 2/7/2020 -- 20:33:55 - - 2 rule files processed. 24761 rules successfully loaded, 0 rules failed ``` in Suricata logs? ---
**Author:** ![netsecuris1](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/netsecuris1/32/89_2.png) [@netsecuris1](https://forum.suricata.io/u/netsecuris1)\ **Post date:** [July 2, 2020, 3:21pm UTC](https://forum.suricata.io/t/suricata-update-and-custom-signature-sets/381/5 "2020-07-02T15:21:28Z")
I found something really weird. suricata.log is not updating. This is a relatively new installation with many restarts of Suricata. Suricata is functioning and giving all kinds of alerts using ET PRO ruleset. ---
**Author:** ![netsecuris1](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/netsecuris1/32/89_2.png) [@netsecuris1](https://forum.suricata.io/u/netsecuris1)\ **Post date:** [July 2, 2020, 3:38pm UTC](https://forum.suricata.io/t/suricata-update-and-custom-signature-sets/381/6 "2020-07-02T15:38:45Z")
I think I found why suricata.log was not updating. It was not enabled in suricata.yaml in the output section. ---
**Author:** ![sbhardwaj](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/sbhardwaj/32/10_2.png) [@sbhardwaj](https://forum.suricata.io/u/sbhardwaj)\ **Post date:** [July 2, 2020, 5:47pm UTC](https://forum.suricata.io/t/suricata-update-and-custom-signature-sets/381/7 "2020-07-02T17:47:07Z")
Great! Could you access the logs and check if the file is getting loaded properly? ---
**Author:** ![netsecuris1](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/netsecuris1/32/89_2.png) [@netsecuris1](https://forum.suricata.io/u/netsecuris1)\ **Post date:** [July 2, 2020, 6:04pm UTC](https://forum.suricata.io/t/suricata-update-and-custom-signature-sets/381/8 "2020-07-02T18:04:51Z")
I will have to wait until I can re-start Suricata. Have to wait for maintenance Window for live system but can try on a test system that is identical to live system.