Error reconfiguring IDS: Error (1) / Hyperscan: Error installing ids rules (1)

[karaman]

New Error Message

[karaman]

Any fixes for this error?

[Markoh]

I had the same Problems to download the rules.

I disabled Suricata and then i deleted all Directories and Files under /usr/local/etc/suricata/opnsense.rules/
reload the config-page and activate ids, then download the rules and all works fine.

[athurdent]

Removing os-intrusion-detection-content-pt-open-1.0 fixed it for me, I am solely using the ET Telemetry ruleset now without problems it seems.

[mimugmail]

To me this happend when IDS process was not running:
https://github.com/opnsense/core/issues/4346

This means that the action worked in general but after this it tries to restart the process which fails, but the reload of rules works

[karaman]

I updated to 7.3

The problem is still not corrected. There are errors when updating Suricata rules.

It there any solution?

[mimugmail]

configd.log please when error appears

[l0stnyc]

So I am not sure if it is related, but I was also having problems when rules were being reloaded every night via cron.  At first I thought it was the abuse.ch rulesets, so I loaded smaller groups of rulesets at a time, it would only fail on the ET rulesets.  So I am not sure if this an issue on ET's end but in the meantime I've just learned to live with it.  Sometimes it works some nights it doesn't.

[jimjohn]

Still got the same problem with the newest OPNsense version. Any update how to fix that?

[alexcccp]

Exactly the same error, but IDS works.

the error disappears after deletion
rm -rf / usr/local/etc/suricata/

BUT! 
IDS stops working immediately after enabling ClamAV + ICAP.

[mimugmail]

Because you have to few RAM? Clamav needs 2gb alone.

[alexcccp]

Because you have to few RAM? Clamav needs 2gb alone.

Yes, it’s out of memory!
I have enabled all IDS  rules for the test.
Perhaps there is a recommendation for the minimum settings for the IDS rules?

[mimugmail]

I would never use it with less than 8

[jimjohn]

Issue still persists, Suricata quits periodically over night (even when there is nearly no traffic).

[mimugmail]

Are you on 21.7.7?