Netgate SG-1000 microFirewall

Author Topic: suricata wont start  (Read 413 times)

0 Members and 1 Guest are viewing this topic.

Offline micropone

  • Jr. Member
  • **
  • Posts: 58
  • Karma: +2/-0
    • View Profile
suricata wont start
« on: December 09, 2017, 02:22:21 pm »
long story short.. I reinstalled pfsense beta.     2.4.3-DEVELOPMENT (amd64)

made changes to nic's.. turned on aes hardware. rebooted.. suricata stopped working..

deleted all of suricata and unchecked keep settings when you uninstall..

reinstall package and all the settings returned..  so I repeated with the uninstall part..deleted anything to do with suracata var/db etc... with the rm command..

installed again and settings still there.. what am I doing wrong?

anyone else?

Offline bmeeks

  • Hero Member
  • *****
  • Posts: 3405
  • Karma: +895/-0
    • View Profile
Re: suricata wont start
« Reply #1 on: December 12, 2017, 03:07:07 pm »
The better place the start threads about the IDS/IPS packages is in that sub-forum, but since we are here I will reply here.

The first thing that usually causes Suricata to fail startup is not enough memory allocated to the Stream Memcap option.  The default is 32 MB, but that number has to increase quite a bit if your CPU has more than 4 cores.  Most folks with 6-core and 8-core CPUs get best results by upping that value to 256 MB.  You will find that setting on the FLOW/STREAM tab for the affected Suricata interface.

Bill

Offline Asterix

  • Hero Member
  • *****
  • Posts: 890
  • Karma: +35/-0
    • View Profile
Re: suricata wont start
« Reply #2 on: January 01, 2018, 02:11:56 pm »
For stream men cap default is 64MB. Flow mem cap is 32MB
« Last Edit: January 01, 2018, 02:18:34 pm by Asterix »