Hi
I installed suricata using tar files and then running ./configure …etc
Now when i wanted to disable few rules set , I found that i don’t have any disable.conf in /usr/local/etc/suricata/
So i created manually and placed that file in /usr/local/etc/suricata
# suricata-update - disable.conf
# Example of disabling a rule by signature ID (gid is optional).
# 1:2019401
# 2019401
# Example of disabling a rule by regular expression.
# - All regular expression matches are case insensitive.
# re:heartbleed
# re:MS(0[7-9]|10)-\d+
# Examples of disabling a group of rules.
# group:emerging-icmp.rules
# group:emerging-dos
# group:emerging*
group:app-layer-events.rules
group:dnp3-events.rules
group:decoder-events.rules
group:dhcp-events.rules
group:ipsec-events.rules
group:kerberos-events.rules
group:modbus-events.rules
group:mqtt-events.rules
group:nfs-events.rules
group:smb-events.rules
group:stream-events.rules
When i run suricata-update , i don’t see this file mentioned anywhere
9/2/2022 -- 14:28:16 - <Info> -- Using data-directory /usr/local/var/lib/suricata.
9/2/2022 -- 14:28:16 - <Info> -- Using Suricata configuration /usr/local/etc/suricata/suricata.yaml
9/2/2022 -- 14:28:16 - <Info> -- Using /usr/local/share/suricata/rules for Suricata provided rules.
9/2/2022 -- 14:28:16 - <Info> -- Found Suricata version 6.0.4 at /usr/local/bin/suricata.
9/2/2022 -- 14:28:16 - <Info> -- Loading /usr/local/etc/suricata/suricata.yaml
9/2/2022 -- 14:28:16 - <Info> -- Disabling rules for protocol http2
9/2/2022 -- 14:28:16 - <Info> -- Disabling rules for protocol modbus
9/2/2022 -- 14:28:16 - <Info> -- Disabling rules for protocol dnp3
9/2/2022 -- 14:28:16 - <Info> -- Disabling rules for protocol enip
9/2/2022 -- 14:28:16 - <Info> -- Last download less than 15 minutes ago. Not downloading https://sslbl.abuse.ch/blacklist/sslblacklist.rules.
9/2/2022 -- 14:28:16 - <Info> -- Last download less than 15 minutes ago. Not downloading https://rules.emergingthreats.net/open/suricata-6.0.4/emerging.rules.tar.gz.
9/2/2022 -- 14:28:16 - <Info> -- Loading distribution rule file /usr/local/share/suricata/rules/app-layer-events.rules
9/2/2022 -- 14:28:16 - <Info> -- Loading distribution rule file /usr/local/share/suricata/rules/decoder-events.rules
9/2/2022 -- 14:28:16 - <Info> -- Loading distribution rule file /usr/local/share/suricata/rules/dhcp-events.rules
9/2/2022 -- 14:28:16 - <Info> -- Loading distribution rule file /usr/local/share/suricata/rules/dnp3-events.rules
9/2/2022 -- 14:28:16 - <Info> -- Loading distribution rule file /usr/local/share/suricata/rules/dns-events.rules
9/2/2022 -- 14:28:16 - <Info> -- Loading distribution rule file /usr/local/share/suricata/rules/files.rules
9/2/2022 -- 14:28:16 - <Info> -- Loading distribution rule file /usr/local/share/suricata/rules/http-events.rules
9/2/2022 -- 14:28:16 - <Info> -- Loading distribution rule file /usr/local/share/suricata/rules/ipsec-events.rules
9/2/2022 -- 14:28:16 - <Info> -- Loading distribution rule file /usr/local/share/suricata/rules/kerberos-events.rules
9/2/2022 -- 14:28:16 - <Info> -- Loading distribution rule file /usr/local/share/suricata/rules/modbus-events.rules
9/2/2022 -- 14:28:16 - <Info> -- Loading distribution rule file /usr/local/share/suricata/rules/nfs-events.rules
9/2/2022 -- 14:28:16 - <Info> -- Loading distribution rule file /usr/local/share/suricata/rules/ntp-events.rules
9/2/2022 -- 14:28:16 - <Info> -- Loading distribution rule file /usr/local/share/suricata/rules/smb-events.rules
9/2/2022 -- 14:28:16 - <Info> -- Loading distribution rule file /usr/local/share/suricata/rules/smtp-events.rules
9/2/2022 -- 14:28:16 - <Info> -- Loading distribution rule file /usr/local/share/suricata/rules/stream-events.rules
9/2/2022 -- 14:28:16 - <Info> -- Loading distribution rule file /usr/local/share/suricata/rules/tls-events.rules
9/2/2022 -- 14:28:16 - <Info> -- Ignoring file rules/emerging-deleted.rules
9/2/2022 -- 14:28:20 - <Info> -- Loaded 36596 rules.
what I am missing can anyone help ,
also I don’t find suricata.service running , is it because I don;t installed it from sudo apt commands ?