# Suricata-update and local file modifies

**URL:** <https://forum.suricata.io/t/suricata-update-and-local-file-modifies/5577>\
**Category:** Rules\
**Created:** [April 2, 2025, 7:26pm UTC](https://forum.suricata.io/t/suricata-update-and-local-file-modifies/5577 "2025-04-02T19:26:40Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![jmtaylor90](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/jmtaylor90/32/20_2.png) [@jmtaylor90](https://forum.suricata.io/u/jmtaylor90)\
**Post date:** [April 2, 2025, 7:26pm UTC](https://forum.suricata.io/t/suricata-update-and-local-file-modifies/5577/1 "2025-04-02T19:26:40Z")

</div>

I am using suricata-update (version 1.3.3) and have a local file with some custom signatures. There are some cases where depending on the suricata/nsm appliance the rules are destined for, where some of the signatures in the local file need to be modified. It seems like suricata-update is not modifying local file sid entries in the modify.conf file. Is this unexpected behavior? I didn’t see any tickets so wondering if this is just an edge case. Thanks in advance!

JT

---

<div class="post-metadata">

**Author:** ![Andreas\_Herz](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/andreas_herz/32/52_2.png) [@Andreas\_Herz](https://forum.suricata.io/u/Andreas_Herz)\
**Post date:** [April 7, 2025, 8:35pm UTC](https://forum.suricata.io/t/suricata-update-and-local-file-modifies/5577/2 "2025-04-07T20:35:16Z")

</div>

Can you generate a rather simple example with configs we could use to try to replicate the issue?

---

<div class="post-metadata">

**Author:** ![ish](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/ish/32/8_2.png) [@ish](https://forum.suricata.io/u/ish)\
**Post date:** [April 8, 2025, 10:55pm UTC](https://forum.suricata.io/t/suricata-update-and-local-file-modifies/5577/3 "2025-04-08T22:55:02Z")

</div>

How are you specifying your local rules?

I just did a test using `--local /path/to/my/local.rules` and the modified versions ended up in the output.

---

<div class="post-metadata">

**Author:** ![jmtaylor90](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/jmtaylor90/32/20_2.png) [@jmtaylor90](https://forum.suricata.io/u/jmtaylor90)\
**Post date:** [April 9, 2025, 12:14pm UTC](https://forum.suricata.io/t/suricata-update-and-local-file-modifies/5577/4 "2025-04-09T12:14:40Z")

</div>

Thank you both. Looks like it’s probably something on my end. I just tried another simplified version and it worked as expected.

JT