[SOLVED] Suricata stopps after a few minutes

[ruggerio]

Hi,

If i reboot the firewall, i have to start suricata manually (already had this in production). Now, in dev, i start suricata, but it stops after a few minutes.

Anybody else having this?

[Ciprian]

Hi!
Yes, me, and for me the culprit was "abuse.ch/URLhaus" ruleset. Stop using it, if you do, and should be fine.
Cheers!

[ruggerio]

again? This issue has already been in Production, but has been fixed...

[franco]

I don't think that has anything to do with 19.1. Reporting crashing services is appreciated, but if the original software authors are not contacted directly the issue fix may be delayed indefinitely. The software authors have deeper insights into what is going on and how we actually faultily configure their service and then we can do something about it.


Cheers,
Franco

[ruggerio]

for sure, but:

after reboot in 18.7, it did not start automatically. Launching Suricata manually was the solution and Suricata kept up running.

Different in 19.1, where it crashes after a restart of the service.

[ruggerio]

disabled urlhaus, survives now reboots.