CLOSED: Issues with Reboot / Power Off from OPNSense GUI running in Unraid VM.

[mrzaz]

Try running "/usr/local/etc/rc.d/suricata onestop" in the terminal and see what happens and then go and check what's in the "Services -> Intrusion Detection -> Log File"

Code Select Expand

/usr/local/etc/rc.d/suricata onestop

I get the following in the console:
root@OPNsense:~ # /usr/local/etc/rc.d/suricata onestop
Stopping suricata.
Waiting for PIDS: 71649.
root@OPNsense:~ #


and the following in Suricata Logfile:

2026-06-25T20:47:04   Notice   suricata   [100787] <Notice> -- (W-8000) Verdict: Accepted 0, Dropped 0
2026-06-25T20:47:04   Notice   suricata   [100787] <Notice> -- (W-8000) Treated: Pkts 0, Bytes 0, Errors 0
2026-06-25T20:47:04   Notice   suricata   [100786] <Notice> -- (W-8000) Verdict: Accepted 0, Dropped 0
2026-06-25T20:47:04   Notice   suricata   [100786] <Notice> -- (W-8000) Treated: Pkts 0, Bytes 0, Errors 0
2026-06-25T20:47:04   Notice   suricata   [100785] <Notice> -- (W-8000) Verdict: Accepted 0, Dropped 0
2026-06-25T20:47:04   Notice   suricata   [100785] <Notice> -- (W-8000) Treated: Pkts 0, Bytes 0, Errors 0
2026-06-25T20:47:03   Notice   suricata   [100642] <Notice> -- Signal Received. Stopping engine.

So when doing this, it shuts down but when it is done as the part of OpnSense shutdown it just hangs.
or at least it says that.  It never passes the killing of PID for surcata.

//Dan Lundqvist

[wincent]

This command "/usr/local/etc/rc.d/suricata onestop" will check the status of Suricata and delete the stale PID file, you previously used `kill` to shut down Suricata abnormally, a PID file may be left behind.
Now try to shut down or reboot OPNsense directly using the webGUI.

[mrzaz]

This command "/usr/local/etc/rc.d/suricata onestop" will check the status of Suricata and delete the stale PID file, you previously used `kill` to shut down Suricata abnormally, a PID file may be left behind.
Now try to shut down or reboot OPNsense directly using the webGUI.

Thanks wincent,
I will save that one for the future. 🙂

I think I have kind of found out why it never shuts down or restart from WebGUI.
What is actually happening is the issue I have reported in other thread regarding PID for suricata never ending.

When I do the shutdown from webgui a lot of the shutdown messages is only seen in the session stdout who starts the shutdown which console is not.
To console is only some part of the later printouts that is printed to all stdout.

But as the system gets stuck endlessly waiting for suricata PID to end the shutdown never proceeds.

If I do the shutdown from console then you will see all sdtout including the hanging suricata PID.

Feels like a corner case that will seldom happen but could possibly be added as a robustness to the shutdown/reboot scripts handling suricata PID or any PID in future releases. 🙂

I propose to close this case and handle it through the other thread.

Best
Dan Lundqvist
Stockholm, Sweden