Where may I find a list of program return codes?

  • Suricata version 7.0.5
  • linux v6.8.9
  • installed Suricata from source

I am experimenting with starting Suricata using systemd. It starts correctly when I issue a command line directly; it does not start correctly using that same command as the value for ExecStart.

2024-05-19T15:03:02-07:00 sma-station14l systemd[1]: Starting Suricata Intrusion Detection Service...
2024-05-19T15:03:02-07:00 sma-station14l systemd[1]: Started Suricata Intrusion Detection Service.
2024-05-19T15:03:02-07:00 sma-station14l systemd[1]: suricata.service: Main process exited, code=exited, status=203/EXEC
2024-05-19T15:03:02-07:00 sma-station14l systemd[1]: suricata.service: Failed with result 'exit-code'.

I have searched Suricata docs and cannot find any mention of the program’s return codes. The man page is silent as well.

The startup failed may be either (1) suricata.yaml misconfigured or (2) the suricata.services misconfigured.

The 203 exit code is not suricata specific but is what systemd is returning. You can find out more about the exit code values and meanings here:

The 203 exit code:
" The actual process execution failed (specifically, the execve(2) system call). Most likely this is caused by a missing or non-accessible executable file."

This is the command line:

/usr/local/bin/suricata -v --pidfile /data01/var/run/suricata.pid -c /usr/local/etc/suricata/suricata.yaml -q 0

It works when executed from a command prompt or a shell script. Not when executed by systemd.

Neither of the explanations for code 203 seem to fit the problem.

suricata.service file:

Description=Suricata Intrusion Detection Service
After=syslog.target network-online.target

ExecStartPre=/bin/rm -f /usr/local/var/run/suricata.pid


And the environment file:

JMM_SURICMD=/usr/local/bin/suricata -v --pidfile /data01/var/run/suricata.pid -c /usr/local/etc/suricata/suricata.yaml -q 0

The use of a variable like that is not supported in systemd. The EnvironmentFile is usually used to provide runtime variables, for instance your value of --pidfile could be specified

and the ExecStart would look something like

Execstart=/usr/local/bin/suricata -v --pidfile ${PIDFILE} -c /usr/local/etc/suricata/suricata.yaml -q 0


I replaced the variable with the actual command line. Same result: code 203.


NOT match.

I think this is the problem.

By the way, pid file will be auto generated and auto deleted by Suricata when starting up and closing down with the suricata.yaml settings.

1 Like

This, as it happens, is true.
I modified ExecStart to usr/local/bin/suricata $JMM_SURIOPT which is the path to Suricata + options. And it started properly. Yay!

1 Like