Error reconfiguring IDS: Error (1) / Hyperscan: Error installing ids rules (1)

[opnrules]

Two seperate issues with similar but slightly different Errors (1).

I can download the rules without a problem and have them all set to drop.
After I intstalled the non commercial rule from the plugins, Error reconfiguring IDS: Error (1) started to occure.

I've since removed that package but the issue persists whenever I download & update rules or make any other change to the settings. Since this started the Rules tab just loads but never shows any results.The IDS however seems to be running.

The other problem I have (and had before above started) is that I also get Error (1) when selecting Hyperscan instead of default.

Is there a way to purge/reset the IDS completely? Could this be related to low memory? Any ideas how to fix this?
Searches for Error (1) in this forum did not yield any results.

Thanks for any suggestions.

[bunchofreeds]

Not sure this is any help, but I run OPNsense as a VM on Proxmox.

I believe Hyperscan is for Intel Architecture CPU's so will only run successfully against those.

When I select a non Intel type CPU for my OPNsense VM via Proxmox and select Hyperscan, I will get Error (1).

[hushcoden]

I'm actually using Hyperscan with my AMD GX-412TC and it works, no errors so far...

[W0nderW0lf]

I have the same issue. Still trying to figure out, why suricata has that much issues with rules since 20.7

[spetrillo]

I am running an Intel 210 and i350 NICs and am getting the error in 20.7.

[hsimah]

Any update on this as I am having the same issue, and started after installing the non-commercial rules plugin.

Code Select Expand

Error reconfiguring IDS
error installing ids rules (Error (1))

[XeroX]

I am running an Intel 210 and i350 NICs and am getting the error in 20.7.

These are network cards, Hyperscan is CPU related.

@opnrules
Hardware specs?

[athurdent]

Same problem here with ET telemetry edition. Rule download ends in Error (1).
Suricata seems to work though, got fresh alarms today.

[karaman]

Same problem

[malac]

same error!

[malac]

i'll unchecked all interfaces and afterwards checked it again. Now the error is gone....

[karaman]

i tried to uncheck all interfaces and checkt again but the error still exists

[malac]

i used "clear all" perhaps this matters???

[athurdent]

No luck unchecking or using clear either, error persists.

[malac]

ok, first i reinstalled the surricata package, but the error still exist.
then i used "clear all" and the error was gone
perhaps it was just good luck....