Show Posts
1
Intrusion Detection and Prevention / Suricata crashing
« on: September 06, 2023, 12:00:32 pm »
Hello,
I am Currently running OPNsense 23.4.2, Business Edition, running it on ESXi. After the upgrade to this version Suricata is crashing after some time when is enabled. Here is what i see in logs. VMX1 is my internet facing port.
How can be this fixed? And how to get rid of warnings.
2023-09-06T11:56:59 Error suricata [107240] <Error> -- [ERRCODE: SC_ERR_FATAL(171)] - opening devname netmap:vmx1/R failed: Invalid argument
2023-09-06T11:54:11 Warning suricata [100483] <Warning> -- [ERRCODE: SC_ERR_CONF_YAML_ERROR(242)] - App-Layer protocol http2 enable status not set, so enabling by default. This behavior will change in Suricata 7, so please update your config. See ticket #4744 for more details.
2023-09-06T11:54:11 Warning suricata [100483] <Warning> -- [ERRCODE: SC_ERR_CONF_YAML_ERROR(242)] - App-Layer protocol http2 enable status not set, so enabling by default. This behavior will change in Suricata 7, so please update your config. See ticket #4744 for more details.
2023-09-06T11:54:11 Warning suricata [100483] <Warning> -- [ERRCODE: SC_ERR_CONF_YAML_ERROR(242)] - App-Layer protocol rdp enable status not set, so enabling by default. This behavior will change in Suricata 7, so please update your config. See ticket #4744 for more details.
2023-09-06T11:54:11 Warning suricata [100483] <Warning> -- [ERRCODE: SC_ERR_CONF_YAML_ERROR(242)] - App-Layer protocol mqtt enable status not set, so enabling by default. This behavior will change in Suricata 7, so please update your config. See ticket #4744 for more details.
2023-09-06T11:54:11 Warning suricata [100483] <Warning> -- [ERRCODE: SC_ERR_CONF_YAML_ERROR(242)] - App-Layer protocol rfb enable status not set, so enabling by default. This behavior will change in Suricata 7, so please update your config. See ticket #4744 for more details.
2023-09-06T11:54:11 Warning suricata [100483] <Warning> -- [ERRCODE: SC_ERR_CONF_YAML_ERROR(242)] - App-Layer protocol sip enable status not set, so enabling by default. This behavior will change in Suricata 7, so please update your config. See ticket #4744 for more details.
I am Currently running OPNsense 23.4.2, Business Edition, running it on ESXi. After the upgrade to this version Suricata is crashing after some time when is enabled. Here is what i see in logs. VMX1 is my internet facing port.
How can be this fixed? And how to get rid of warnings.
2023-09-06T11:56:59 Error suricata [107240] <Error> -- [ERRCODE: SC_ERR_FATAL(171)] - opening devname netmap:vmx1/R failed: Invalid argument
2023-09-06T11:54:11 Warning suricata [100483] <Warning> -- [ERRCODE: SC_ERR_CONF_YAML_ERROR(242)] - App-Layer protocol http2 enable status not set, so enabling by default. This behavior will change in Suricata 7, so please update your config. See ticket #4744 for more details.
2023-09-06T11:54:11 Warning suricata [100483] <Warning> -- [ERRCODE: SC_ERR_CONF_YAML_ERROR(242)] - App-Layer protocol http2 enable status not set, so enabling by default. This behavior will change in Suricata 7, so please update your config. See ticket #4744 for more details.
2023-09-06T11:54:11 Warning suricata [100483] <Warning> -- [ERRCODE: SC_ERR_CONF_YAML_ERROR(242)] - App-Layer protocol rdp enable status not set, so enabling by default. This behavior will change in Suricata 7, so please update your config. See ticket #4744 for more details.
2023-09-06T11:54:11 Warning suricata [100483] <Warning> -- [ERRCODE: SC_ERR_CONF_YAML_ERROR(242)] - App-Layer protocol mqtt enable status not set, so enabling by default. This behavior will change in Suricata 7, so please update your config. See ticket #4744 for more details.
2023-09-06T11:54:11 Warning suricata [100483] <Warning> -- [ERRCODE: SC_ERR_CONF_YAML_ERROR(242)] - App-Layer protocol rfb enable status not set, so enabling by default. This behavior will change in Suricata 7, so please update your config. See ticket #4744 for more details.
2023-09-06T11:54:11 Warning suricata [100483] <Warning> -- [ERRCODE: SC_ERR_CONF_YAML_ERROR(242)] - App-Layer protocol sip enable status not set, so enabling by default. This behavior will change in Suricata 7, so please update your config. See ticket #4744 for more details.