Trying to update Suricata on Oracle VM and get an error

when trying to update Suricata using “sudo suricata-update” I get:

– [ERRCODE: SC_ERR_CONF_YAML_ERROR(242)] - Failed to parse configuration file at line 12: did not find expected < document start>

this is line 12:

“# This configuration file generated by Suricata 6.0.13.”

any idea how to fix that?

edit: checked for errors using yamllint /etc/suricata/suricata.yaml
and got:

7:1 error too many blank lines (3 > 2) (empty-lines)
13:1 error syntax error: expected ‘’, but found ‘’ (syntax)
23:6 warning missing starting space in comment (comments)
24:6 warning missing starting space in comment (comments)
25:6 warning missing starting space in comment (comments)
26:6 warning missing starting space in comment (comments)
29:6 warning missing starting space in comment (comments)
69:12 warning truthy value should be one of [false, true] (truthy)
74:4 warning missing starting space in comment (comments)
77:4 warning missing starting space in comment (comments)
79:4 warning missing starting space in comment (comments)
85:16 warning truthy value should be one of [false, true] (truthy)
87:15 warning truthy value should be one of [false, true] (truthy)
88:8 warning missing starting space in comment (comments)
92:16 warning truthy value should be one of [false, true] (truthy)
93:25 warning too few spaces before comment (comments)
93:26 warning missing starting space in comment (comments)
97:8 warning missing starting space in comment (comments)
98:8 warning missing starting space in comment (comments)
100:8 warning missing starting space in comment (comments)
101:8 warning missing starting space in comment (comments)
102:8 warning missing starting space in comment (comments)
103:20 warning comment not indented like content (comments-indentation)
104:8 warning missing starting space in comment (comments)
105:8 warning missing starting space in comment (comments)
109:81 error line too long (84 > 80 characters) (line-length)
110:81 error line too long (91 > 80 characters) (line-length)
111:81 error line too long (90 > 80 characters) (line-length)
122:8 warning missing starting space in comment (comments)
146:18 warning truthy value should be one of [false, true] (truthy)
161:81 error line too long (88 > 80 characters) (line-length)
162:81 error line too long (91 > 80 characters) (line-length)
163:81 error line too long (91 > 80 characters) (line-length)
164:81 error line too long (103 > 80 characters) (line-length)
165:81 error line too long (97 > 80 characters) (line-length)
166:81 error line too long (107 > 80 characters) (line-length)
170:29 warning truthy value should be one of [false, true] (truthy)
196:22 warning truthy value should be one of [false, true] (truthy)
201:15 warning comment not indented like content (comments-indentation)
204:14 warning missing starting space in comment (comments)
204:13 warning comment not indented like content (comments-indentation)
206:23 warning truthy value should be one of [false, true] (truthy)
209:14 warning missing starting space in comment (comments)
214:13 warning comment not indented like content (comments-indentation)
220:14 warning missing starting space in comment (comments)
223:14 warning missing starting space in comment (comments)
229:14 warning missing starting space in comment (comments)
230:14 warning missing starting space in comment (comments)
236:14 warning missing starting space in comment (comments)
240:14 warning missing starting space in comment (comments)
242:23 warning truthy value should be one of [false, true] (truthy)
245:14 warning missing starting space in comment (comments)
247:14 warning missing starting space in comment (comments)
247:81 error line too long (144 > 80 characters) (line-length)
249:26 warning truthy value should be one of [false, true] (truthy)
252:14 warning missing starting space in comment (comments)
253:10 warning missing starting space in comment (comments)
258:14 warning missing starting space in comment (comments)
258:13 warning comment not indented like content (comments-indentation)
261:81 error line too long (82 > 80 characters) (line-length)
264:14 warning missing starting space in comment (comments)
264:81 error line too long (82 > 80 characters) (line-length)
266:81 error line too long (81 > 80 characters) (line-length)
268:14 warning missing starting space in comment (comments)
270:10 warning missing starting space in comment (comments)
283:22 warning truthy value should be one of [false, true] (truthy)
288:23 warning truthy value should be one of [false, true] (truthy)
291:13 warning comment not indented like content (comments-indentation)
295:10 warning missing starting space in comment (comments)
297:21 warning truthy value should be one of [false, true] (truthy)
298:22 warning truthy value should be one of [false, true] (truthy)
299:21 warning truthy value should be one of [false, true] (truthy)
303:10 warning missing starting space in comment (comments)
308:10 warning missing starting space in comment (comments)
312:16 warning truthy value should be one of [false, true] (truthy)
314:15 warning truthy value should be one of [false, true] (truthy)
315:8 warning missing starting space in comment (comments)
316:8 warning missing starting space in comment (comments)
316:81 error line too long (85 > 80 characters) (line-length)
317:8 warning missing starting space in comment (comments)
317:81 error line too long (94 > 80 characters) (line-length)
318:8 warning missing starting space in comment (comments)
322:16 warning truthy value should be one of [false, true] (truthy)
323:25 warning too few spaces before comment (comments)
324:15 warning truthy value should be one of [false, true] (truthy)
325:8 warning missing starting space in comment (comments)
326:8 warning missing starting space in comment (comments)
326:81 error line too long (86 > 80 characters) (line-length)
327:8 warning missing starting space in comment (comments)
328:8 warning missing starting space in comment (comments)
331:8 warning missing starting space in comment (comments)
335:16 warning truthy value should be one of [false, true] (truthy)
336:8 warning missing starting space in comment (comments)
369:16 warning truthy value should be one of [false, true] (truthy)
388:8 warning missing starting space in comment (comments)
389:8 warning missing starting space in comment (comments)
391:20 warning too few spaces before comment (comments)
395:8 warning missing starting space in comment (comments)
397:8 warning missing starting space in comment (comments)
397:81 error line too long (102 > 80 characters) (line-length)
398:25 warning truthy value should be one of [false, true] (truthy)
398:28 warning too few spaces before comment (comments)
398:29 warning missing starting space in comment (comments)
398:81 error line too long (130 > 80 characters) (line-length)
399:25 warning truthy value should be one of [false, true] (truthy)
399:28 warning too few spaces before comment (comments)
399:81 error line too long (104 > 80 characters) (line-length)
404:16 warning truthy value should be one of [false, true] (truthy)
406:15 warning truthy value should be one of [false, true] (truthy)
407:8 warning missing starting space in comment (comments)
412:16 warning truthy value should be one of [false, true] (truthy)
414:27 warning truthy value should be one of [false, true] (truthy)
415:26 warning truthy value should be one of [false, true] (truthy)
419:16 warning truthy value should be one of [false, true] (truthy)
421:15 warning truthy value should be one of [false, true] (truthy)
422:15 warning truthy value should be one of [false, true] (truthy)
423:16 warning truthy value should be one of [false, true] (truthy)
424:8 warning missing starting space in comment (comments)
428:16 warning truthy value should be one of [false, true] (truthy)
431:8 warning missing starting space in comment (comments)
433:8 warning missing starting space in comment (comments)
434:20 warning comment not indented like content (comments-indentation)
454:16 warning truthy value should be one of [false, true] (truthy)
458:8 warning missing starting space in comment (comments)
463:8 warning missing starting space in comment (comments)
466:8 warning missing starting space in comment (comments)
471:8 warning missing starting space in comment (comments)
476:8 warning missing starting space in comment (comments)
482:8 warning missing starting space in comment (comments)
490:18 warning truthy value should be one of [false, true] (truthy)
511:16 warning truthy value should be one of [false, true] (truthy)
524:16 warning truthy value should be one of [false, true] (truthy)
533:16 warning truthy value should be one of [false, true] (truthy)
534:8 warning missing starting space in comment (comments)
553:4 warning missing starting space in comment (comments)
564:4 warning missing starting space in comment (comments)
569:3 error wrong indentation: expected 4 but found 2 (indentation)
570:16 warning truthy value should be one of [false, true] (truthy)
573:16 warning truthy value should be one of [false, true] (truthy)
578:16 warning truthy value should be one of [false, true] (truthy)
595:6 warning missing starting space in comment (comments)
598:81 error line too long (86 > 80 characters) (line-length)
602:81 error line too long (88 > 80 characters) (line-length)
603:81 error line too long (91 > 80 characters) (line-length)
605:81 error line too long (100 > 80 characters) (line-length)
607:81 error line too long (94 > 80 characters) (line-length)
608:81 error line too long (86 > 80 characters) (line-length)
610:81 error line too long (83 > 80 characters) (line-length)
611:81 error line too long (87 > 80 characters) (line-length)
612:13 warning truthy value should be one of [false, true] (truthy)
614:6 warning missing starting space in comment (comments)
617:6 warning missing starting space in comment (comments)
620:6 warning missing starting space in comment (comments)
621:81 error line too long (81 > 80 characters) (line-length)
622:81 error line too long (84 > 80 characters) (line-length)
623:81 error line too long (87 > 80 characters) (line-length)
624:81 error line too long (91 > 80 characters) (line-length)
626:6 warning missing starting space in comment (comments)
627:81 error line too long (92 > 80 characters) (line-length)
628:81 error line too long (92 > 80 characters) (line-length)
630:6 warning missing starting space in comment (comments)
631:81 error line too long (81 > 80 characters) (line-length)
633:6 warning missing starting space in comment (comments)
635:81 error line too long (88 > 80 characters) (line-length)
636:6 warning missing starting space in comment (comments)
650:81 error line too long (86 > 80 characters) (line-length)
651:6 warning missing starting space in comment (comments)
652:81 error line too long (81 > 80 characters) (line-length)
653:6 warning missing starting space in comment (comments)
659:6 warning missing starting space in comment (comments)
660:6 warning missing starting space in comment (comments)
661:81 error line too long (81 > 80 characters) (line-length)
672:6 warning missing starting space in comment (comments)
672:5 warning comment not indented like content (comments-indentation)
673:6 warning missing starting space in comment (comments)
674:6 warning missing starting space in comment (comments)
679:5 warning comment not indented like content (comments-indentation)
682:6 warning missing starting space in comment (comments)
683:6 warning missing starting space in comment (comments)
692:81 error line too long (86 > 80 characters) (line-length)
693:6 warning missing starting space in comment (comments)
695:81 error line too long (82 > 80 characters) (line-length)
698:6 warning missing starting space in comment (comments)
700:6 warning missing starting space in comment (comments)
703:6 warning missing starting space in comment (comments)
706:6 warning missing starting space in comment (comments)
706:5 warning comment not indented like content (comments-indentation)
741:16 warning truthy value should be one of [false, true] (truthy)
746:16 warning truthy value should be one of [false, true] (truthy)
753:16 warning truthy value should be one of [false, true] (truthy)
755:16 warning truthy value should be one of [false, true] (truthy)
757:16 warning truthy value should be one of [false, true] (truthy)
759:16 warning truthy value should be one of [false, true] (truthy)
763:7 warning comment not indented like content (comments-indentation)
765:8 warning missing starting space in comment (comments)
779:8 warning missing starting space in comment (comments)
782:16 warning truthy value should be one of [false, true] (truthy)
784:16 warning truthy value should be one of [false, true] (truthy)
787:16 warning truthy value should be one of [false, true] (truthy)
789:16 warning truthy value should be one of [false, true] (truthy)
790:8 warning missing starting space in comment (comments)
793:16 warning truthy value should be one of [false, true] (truthy)
795:20 warning truthy value should be one of [false, true] (truthy)
797:16 warning truthy value should be one of [false, true] (truthy)
798:23 warning truthy value should be one of [false, true] (truthy)
805:22 warning truthy value should be one of [false, true] (truthy)
808:24 warning truthy value should be one of [false, true] (truthy)
809:34 warning truthy value should be one of [false, true] (truthy)
816:23 warning truthy value should be one of [false, true] (truthy)
819:19 warning truthy value should be one of [false, true] (truthy)
828:16 warning truthy value should be one of [false, true] (truthy)
832:7 warning comment not indented like content (comments-indentation)
833:8 warning missing starting space in comment (comments)
836:16 warning truthy value should be one of [false, true] (truthy)
838:16 warning truthy value should be one of [false, true] (truthy)
841:18 warning truthy value should be one of [false, true] (truthy)
845:18 warning truthy value should be one of [false, true] (truthy)
849:16 warning truthy value should be one of [false, true] (truthy)
855:81 error line too long (81 > 80 characters) (line-length)
857:81 error line too long (82 > 80 characters) (line-length)
858:81 error line too long (82 > 80 characters) (line-length)
863:81 error line too long (89 > 80 characters) (line-length)
864:81 error line too long (81 > 80 characters) (line-length)
867:81 error line too long (92 > 80 characters) (line-length)
873:10 error wrong indentation: expected 8 but found 9 (indentation)
890:81 error line too long (89 > 80 characters) (line-length)
894:81 error line too long (82 > 80 characters) (line-length)
902:23 warning truthy value should be one of [false, true] (truthy)
910:13 warning missing starting space in comment (comments)
915:13 warning missing starting space in comment (comments)
918:32 warning truthy value should be one of [false, true] (truthy)
919:33 warning truthy value should be one of [false, true] (truthy)
922:13 warning missing starting space in comment (comments)
925:13 warning missing starting space in comment (comments)
928:13 warning missing starting space in comment (comments)
930:13 warning missing starting space in comment (comments)
934:13 warning missing starting space in comment (comments)
934:12 warning comment not indented like content (comments-indentation)
944:13 warning missing starting space in comment (comments)
956:81 error line too long (84 > 80 characters) (line-length)
964:8 warning missing starting space in comment (comments)
966:16 warning truthy value should be one of [false, true] (truthy)
980:16 warning truthy value should be one of [false, true] (truthy)
986:16 warning truthy value should be one of [false, true] (truthy)
992:16 warning truthy value should be one of [false, true] (truthy)
995:16 warning truthy value should be one of [false, true] (truthy)
998:16 warning truthy value should be one of [false, true] (truthy)
1008:6 warning missing starting space in comment (comments)
1008:5 warning comment not indented like content (comments-indentation)
1009:6 warning missing starting space in comment (comments)
1012:5 warning comment not indented like content (comments-indentation)
1015:6 warning missing starting space in comment (comments)
1020:6 warning missing starting space in comment (comments)
1033:2 warning missing starting space in comment (comments)
1039:5 warning comment not indented like content (comments-indentation)
1040:6 warning missing starting space in comment (comments)
1044:2 warning missing starting space in comment (comments)
1049:2 warning missing starting space in comment (comments)
1054:2 warning missing starting space in comment (comments)
1059:2 warning missing starting space in comment (comments)
1073:81 error line too long (82 > 80 characters) (line-length)
1080:81 error line too long (82 > 80 characters) (line-length)
1080:82 error trailing spaces (trailing-spaces)
1081:76 error trailing spaces (trailing-spaces)
1083:2 warning missing starting space in comment (comments)
1085:81 error line too long (82 > 80 characters) (line-length)
1086:81 error line too long (82 > 80 characters) (line-length)
1088:2 warning missing starting space in comment (comments)
1097:2 warning missing starting space in comment (comments)
1102:2 warning missing starting space in comment (comments)
1112:4 warning missing starting space in comment (comments)
1115:2 warning missing starting space in comment (comments)
1116:2 warning missing starting space in comment (comments)
1116:13 error trailing spaces (trailing-spaces)
1120:2 warning missing starting space in comment (comments)
1139:2 warning missing starting space in comment (comments)
1142:2 warning missing starting space in comment (comments)
1143:2 warning missing starting space in comment (comments)
1144:2 warning missing starting space in comment (comments)
1154:23 warning truthy value should be one of [false, true] (truthy)
1156:10 warning truthy value should be one of [false, true] (truthy)
1158:2 warning missing starting space in comment (comments)
1194:19 warning too few spaces before comment (comments)
1195:20 warning too few spaces before comment (comments)
1196:13 warning truthy value should be one of [false, true] (truthy)
1204:81 error line too long (100 > 80 characters) (line-length)
1237:4 warning missing starting space in comment (comments)
1241:4 warning missing starting space in comment (comments)
1242:4 warning missing starting space in comment (comments)
1253:81 error line too long (82 > 80 characters) (line-length)
1261:81 error line too long (83 > 80 characters) (line-length)
1315:81 error line too long (87 > 80 characters) (line-length)
1318:81 error line too long (84 > 80 characters) (line-length)
1319:81 error line too long (87 > 80 characters) (line-length)
1320:81 error line too long (84 > 80 characters) (line-length)
1329:81 error line too long (112 > 80 characters) (line-length)
1331:81 error line too long (89 > 80 characters) (line-length)
1334:81 error line too long (91 > 80 characters) (line-length)
1335:81 error line too long (90 > 80 characters) (line-length)
1351:81 error line too long (96 > 80 characters) (line-length)
1352:81 error line too long (96 > 80 characters) (line-length)
1353:81 error line too long (98 > 80 characters) (line-length)
1354:81 error line too long (95 > 80 characters) (line-length)
1355:81 error line too long (108 > 80 characters) (line-length)
1356:81 error line too long (102 > 80 characters) (line-length)
1371:81 error line too long (97 > 80 characters) (line-length)
1376:4 warning missing starting space in comment (comments)
1377:24 warning truthy value should be one of [false, true] (truthy)
1378:4 warning missing starting space in comment (comments)
1379:4 warning missing starting space in comment (comments)
1380:81 error line too long (100 > 80 characters) (line-length)
1383:6 warning missing starting space in comment (comments)
1387:27 warning truthy value should be one of [false, true] (truthy)
1388:6 warning missing starting space in comment (comments)
1389:6 warning missing starting space in comment (comments)
1390:6 warning missing starting space in comment (comments)
1391:6 warning missing starting space in comment (comments)
1406:2 warning missing starting space in comment (comments)
1420:26 warning too few spaces before comment (comments)
1426:25 warning too few spaces before comment (comments)
1436:26 warning too few spaces before comment (comments)
1438:3 warning comment not indented like content (comments-indentation)
1463:81 error line too long (86 > 80 characters) (line-length)
1473:4 warning missing starting space in comment (comments)
1486:6 warning missing starting space in comment (comments)
1486:5 warning comment not indented like content (comments-indentation)
1487:6 warning missing starting space in comment (comments)
1494:6 warning missing starting space in comment (comments)
1532:21 warning truthy value should be one of [false, true] (truthy)
1546:15 error too many spaces inside brackets (brackets)
1546:17 error too many spaces inside brackets (brackets)
1548:15 error too many spaces inside brackets (brackets)
1548:17 error too many spaces inside brackets (brackets)
1550:15 error too many spaces inside brackets (brackets)
1550:21 error too many spaces inside brackets (brackets)
1556:17 error too many spaces inside brackets (brackets)
1556:19 error too many spaces inside brackets (brackets)
1557:20 error too many spaces inside brackets (brackets)
1557:26 error too many spaces inside brackets (brackets)
1558:18 error too many spaces inside brackets (brackets)
1558:20 error too many spaces inside brackets (brackets)
1560:6 warning missing starting space in comment (comments)
1560:5 warning comment not indented like content (comments-indentation)
1581:4 warning missing starting space in comment (comments)
1599:4 warning missing starting space in comment (comments)
1606:14 warning truthy value should be one of [false, true] (truthy)
1608:13 warning truthy value should be one of [false, true] (truthy)
1612:6 warning missing starting space in comment (comments)
1618:11 warning truthy value should be one of [false, true] (truthy)
1622:14 warning truthy value should be one of [false, true] (truthy)
1624:13 warning truthy value should be one of [false, true] (truthy)
1627:14 warning truthy value should be one of [false, true] (truthy)
1629:13 warning truthy value should be one of [false, true] (truthy)
1633:14 warning truthy value should be one of [false, true] (truthy)
1635:13 warning truthy value should be one of [false, true] (truthy)
1642:14 warning truthy value should be one of [false, true] (truthy)
1644:13 warning truthy value should be one of [false, true] (truthy)
1651:16 warning truthy value should be one of [false, true] (truthy)
1657:14 warning truthy value should be one of [false, true] (truthy)
1659:13 warning truthy value should be one of [false, true] (truthy)
1662:14 warning truthy value should be one of [false, true] (truthy)
1664:13 warning truthy value should be one of [false, true] (truthy)
1696:2 warning missing starting space in comment (comments)
1698:5 warning comment not indented like content (comments-indentation)
1719:3 warning comment not indented like content (comments-indentation)
1721:4 warning missing starting space in comment (comments)
1725:4 warning missing starting space in comment (comments)
1730:81 error line too long (82 > 80 characters) (line-length)
1739:4 warning comment not indented like content (comments-indentation)
1740:2 error wrong indentation: expected 2 but found 1 (indentation)
1741:4 warning comment not indented like content (comments-indentation)
1744:5 warning missing starting space in comment (comments)
1750:81 error line too long (81 > 80 characters) (line-length)
1752:81 error line too long (83 > 80 characters) (line-length)
1754:81 error line too long (93 > 80 characters) (line-length)
1756:5 warning missing starting space in comment (comments)
1757:5 warning missing starting space in comment (comments)
1769:5 warning missing starting space in comment (comments)
1771:5 warning missing starting space in comment (comments)
1772:3 warning missing starting space in comment (comments)
1773:5 warning missing starting space in comment (comments)
1773:4 warning comment not indented like content (comments-indentation)
1774:5 warning missing starting space in comment (comments)
1775:5 warning missing starting space in comment (comments)
1794:81 error line too long (94 > 80 characters) (line-length)
1795:81 error line too long (94 > 80 characters) (line-length)
1796:81 error line too long (94 > 80 characters) (line-length)
1797:81 error line too long (94 > 80 characters) (line-length)
1798:81 error line too long (94 > 80 characters) (line-length)
1803:6 warning missing starting space in comment (comments)
1808:6 warning missing starting space in comment (comments)
1820:6 warning missing starting space in comment (comments)
1822:4 warning missing starting space in comment (comments)
1828:6 warning missing starting space in comment (comments)
1828:5 warning comment not indented like content (comments-indentation)
1843:3 warning comment not indented like content (comments-indentation)
1864:6 warning missing starting space in comment (comments)
1866:81 error line too long (81 > 80 characters) (line-length)
1872:5 error wrong indentation: expected 2 but found 4 (indentation)
1877:26 warning truthy value should be one of [false, true] (truthy)
1890:18 warning truthy value should be one of [false, true] (truthy)
1894:22 warning truthy value should be one of [false, true] (truthy)
1899:13 warning truthy value should be one of [false, true] (truthy)
1909:81 error line too long (82 > 80 characters) (line-length)
1910:81 error line too long (85 > 80 characters) (line-length)
1914:81 error line too long (82 > 80 characters) (line-length)
1921:81 error line too long (86 > 80 characters) (line-length)
1933:17 error too few spaces after comma (commas)

Hi, @tomer_zamir ! Welcome to our forum! :slight_smile:

As you found with the linter, your YAML is improperly formatted for some reason. How did you install Suricata?
If you do a make install-full again, suricata will regenerate all the conf files and that should work out.

thank you for the reply :smile:

the problem is now fixed, I found a ‘;’ at line 3 that shouldn’t have been there.

I have however encountered another problem but in running elastic search, would you by any chance be able to help me with that?

Please start a new thread. If I am able to understand, I’ll try. :slight_smile:

alright, just did. [=