# Suricata-update question abou file update.yaml

**URL:** <https://forum.suricata.io/t/suricata-update-question-abou-file-update-yaml/3621>\
**Category:** Help\
**Created:** [June 21, 2023, 8:53am UTC](https://forum.suricata.io/t/suricata-update-question-abou-file-update-yaml/3621 "2023-06-21T08:53:02Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![gosudvtnews](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/gosudvtnews/32/2458_2.png) [@gosudvtnews](https://forum.suricata.io/u/gosudvtnews)\
**Post date:** [June 21, 2023, 8:53am UTC](https://forum.suricata.io/t/suricata-update-question-abou-file-update-yaml/3621/1 "2023-06-21T08:53:02Z")

</div>

Here is sample update.yaml file, when i change line **disable-conf:/etc/suricata/disable.conf to disable-conf:/path/to/sample.conf** =\> Is Not Working. How i can modify this file to apply new cusotmize disable/enable config file with suricata-update

 ![image](https://canada1.discourse-cdn.com/flex030/uploads/suricata/original/2X/3/37bcc4d8b3579b17cf84f7baae681164a92f75e4.png)

---

<div class="post-metadata">

**Author:** ![ish](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/ish/32/8_2.png) [@ish](https://forum.suricata.io/u/ish)\
**Post date:** [June 21, 2023, 2:54pm UTC](https://forum.suricata.io/t/suricata-update-question-abou-file-update-yaml/3621/2 "2023-06-21T14:54:58Z")

</div>

Can you explain how its not working?

Does your `/path/to/sample.conf` exist?

---

<div class="post-metadata">

**Author:** ![gosudvtnews](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/gosudvtnews/32/2458_2.png) [@gosudvtnews](https://forum.suricata.io/u/gosudvtnews)\
**Post date:** [June 22, 2023, 2:44am UTC](https://forum.suricata.io/t/suricata-update-question-abou-file-update-yaml/3621/3 "2023-06-22T02:44:40Z")

</div>

**1 - Here is my config in update.yaml.**

 ![image](https://canada1.discourse-cdn.com/flex030/uploads/suricata/original/2X/7/7adcc0d6b8ddb602862d791b5ebbbd080296b76e.png)

**2 - When i have two file disable.conf and disable\_test.conf the update.yaml always using disable.conf**  
 ![image](https://canada1.discourse-cdn.com/flex030/uploads/suricata/original/2X/0/0b2bd3ae909742ca0cf84fa4ee9c3b0af7ebae6d.png)

**3 - When i change the name of disable.conf to something elsse =\> Is Working**  
 ![image](https://canada1.discourse-cdn.com/flex030/uploads/suricata/original/2X/9/94bbb1f55af8844a47851d3bfcc1bb486e0a0615.png)

---

<div class="post-metadata">

**Author:** ![gosudvtnews](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/gosudvtnews/32/2458_2.png) [@gosudvtnews](https://forum.suricata.io/u/gosudvtnews)\
**Post date:** [June 22, 2023, 3:12am UTC](https://forum.suricata.io/t/suricata-update-question-abou-file-update-yaml/3621/4 "2023-06-22T03:12:51Z")

</div>

**I create new folder, move .conf and update.yaml from /etc/suricata to it =\> Is Working**

---

<div class="post-metadata">

**Author:** ![sscally](https://avatars.discourse-cdn.com/v4/letter/s/ccd318/32.png) [@sscally](https://forum.suricata.io/u/sscally)\
**Post date:** [June 22, 2023, 8:16pm UTC](https://forum.suricata.io/t/suricata-update-question-abou-file-update-yaml/3621/5 "2023-06-22T20:16:29Z")

</div>

It is most likely the underscore in the filename. Try escaping or quoting the filename or using something like “disable.test.conf” as the filename.

---

<div class="post-metadata">

**Author:** ![ish](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/ish/32/8_2.png) [@ish](https://forum.suricata.io/u/ish)\
**Post date:** [June 22, 2023, 8:21pm UTC](https://forum.suricata.io/t/suricata-update-question-abou-file-update-yaml/3621/6 "2023-06-22T20:21:32Z")

</div>

This could be a bug. It might be preferring the existence of `/etc/suricata/disable.conf` over what is supplied in `/etc/suricata/update.yaml`. If this is the case, adding the command line option `--disable-conf /path/to/disable.conf` should override, and I’ll be looking further into this.

> **[Bug #6172: update.yaml: configured disable.conf not being respected -...](https://redmine.openinfosecfoundation.org/issues/6172)**
>
> Redmine
