Error reconfiguring IDS: Error (1) / Hyperscan: Error installing ids rules (1)

[jimjohn]

Yes.

[Bogotrax]

Exactly the same error, but IDS works.

the error disappears after deletion
rm -rf / usr/local/etc/suricata/

BUT! 
IDS stops working immediately after enabling ClamAV + ICAP.

Where do you apply rm - is there a terminal through the webinterface where you can do this?

[Julien]

ok, first i reinstalled the surricata package, but the error still exist.
then i used "clear all" and the error was gone
perhaps it was just good luck....

i am having the same issue with one box, what do you mean with clear all?
Thank you

[yeraycito]

On a clean install of Opnsense 22.1 the error still appears.

[jimjohn]

Could it be memory related? Not enough memory on low-power boxes?

[yeraycito]

No, I have on my Opnsense mini-pc 8 GB of memory. Opnsense + Suricata take up 15% of memory.

[vijvis]

Running 22.1 on a Protectli Mini PC. I got the error as well upon enabling IPS. Didn't get the error when running in IDS mode. Rebooting the device seems to have fixed it for me and IPS is running normally.

[Qu0th]

Running 22.1 on a Protectli Mini PC. I got the error as well upon enabling IPS. Didn't get the error when running in IDS mode. Rebooting the device seems to have fixed it for me and IPS is running normally.

I have the same exact setup and error.

[jkellerer]

Had the issue today as well after modifying policies. Added a "%" in the policy description and this broke regeneration of rules. Removing "%" fixed it.

Since sqlite is used in the backend, I assume the policy descriptions are not properly escaped and can break SQL statements if certain characters are used. It may not be the only reason for this error but it is one possible cause.