Thank you for the quick response Duarte!<br><br>I tried comment the line that wrote the PID to the PIDFILE in my init.d script (also tried using a sleep 2 without commenting). This is time there is no error on the start.log but when i check the service status it says PID file /var/run/suricata.pid exists, but process not running!<br>
<br>init.d script:<br>NAME=suricata<br>DAEMON=/usr/local/suricata/current/bin/$NAME<br>SURCONF=/etc/suricata/suricata.yaml<br>PIDFILE=/var/run/suricata.pid<br>IDMODE=pfring <br><br>...<br>...<br><br>SURICATA_OPTIONS=" -c $SURCONF --pidfile $PIDFILE --pfring -D"<br>
<br>case "$1" in<br> start)<br> if [ -f $PIDFILE ]; then<br> PID1=`cat $PIDFILE`<br> if kill -0 "$PID1" 2>/dev/null; then<br> echo "$NAME is already running with PID $PID1"<br>
exit 0<br> fi<br> fi<br> echo -n "Starting suricata in $IDMODE mode..."<br> $DAEMON $SURICATA_OPTIONS > /var/log/suricata/suricata-start.log 2>&1 &<br> PID1=$!<br>
<br> sleep 2 ### JUST ADDED<br> echo "$PID1" > $PIDFILE<br> echo " done."<br> ;;<br>-------<br><br><br>cat /var/log/suricata/suricata-start.log<br>26/2/2013 -- 17:28:22 - <Info> - This is Suricata version 1.4 RELEASE<br>
26/2/2013 -- 17:28:22 - <Info> - CPUs/cores online: 16<br>26/2/2013 -- 17:28:22 - <Info> - Failure when trying to get MTU via ioctl: 19<br>26/2/2013 -- 17:28:22 - <Error> - [ERRCODE: SC_ERR_MISSING_CONFIG_PARAM(118)] - NO logging compatible with daemon mode selected, suricata won't be able to log. Please update 'logging.outputs' in the YAML.<br>
26/2/2013 -- 17:28:22 - <Info> - allocated 3670016 bytes of memory for the defrag hash... 65536 buckets of size 56<br>26/2/2013 -- 17:28:22 - <Info> - preallocated 65535 defrag trackers of size 144<br>26/2/2013 -- 17:28:22 - <Info> - defrag memory usage: 13107056 bytes, maximum: 33554432<br>
26/2/2013 -- 17:28:22 - <Info> - AutoFP mode using default "Active Packets" flow load balancer<br><br><br>If there any file that would give more details about why the process is failing to start?<br><br>Thanks,<br>
Benson<br><br><br><div class="gmail_quote">On Tue, Feb 26, 2013 at 4:46 PM, Duarte Silva <span dir="ltr"><<a href="mailto:duarte.silva@serializing.me" target="_blank">duarte.silva@serializing.me</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><p dir="ltr">Hi,</p>
<p dir="ltr">that happened to me whe I started Suricata with the init.d script. That's because the init.d script forks Suricata to the background and then creates a pid file before Suricata. If you remove the line that echos the Suricata process identifier to the pid file, it should work fine.</p>
<p dir="ltr">Best regards, <br>
Duarte Silva</p>
<div class="gmail_quote"><div><div class="h5">On 26 Feb 2013 21:32, "Benson Mathews" <<a href="mailto:benson.mathews@gmail.com" target="_blank">benson.mathews@gmail.com</a>> wrote:<br type="attribution"></div>
</div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div><div class="h5">
Hi,<br><br>I just installed Suricata 1.4 on my server and I'm attempting to run it with PF_RINGS, but I get the following error while I start suricata.<br>cat /var/log/suricata/suricata-start.log<br>26/2/2013 -- 00:03:18 - <Info> - This is Suricata version 1.4 RELEASE<br>
26/2/2013 -- 00:03:18 - <Info> - CPUs/cores online: 16<br>26/2/2013 -- 00:03:18 - <Info> - Failure when trying to get MTU via ioctl: 19<br>26/2/2013 -- 00:03:18 - <Error> - [ERRCODE: SC_ERR_MISSING_CONFIG_PARAM(118)] - NO logging compatible with daemon mode selected, suricata won't be able to log. Please update 'logging.outputs' in the YAML.<br>
26/2/2013 -- 00:03:18 - <Info> - allocated 3670016 bytes of memory for the defrag hash... 65536 buckets of size 56<br>26/2/2013 -- 00:03:18 - <Info> - preallocated 65535 defrag trackers of size 144<br>26/2/2013 -- 00:03:18 - <Info> - defrag memory usage: <a href="tel:13107056" value="+13107056" target="_blank">13107056</a> bytes, maximum: 33554432<br>
26/2/2013 -- 00:03:18 - <Info> - AutoFP mode using default "Active Packets" flow load balancer<br>26/2/2013 -- 00:03:18 - <Error> - [ERRCODE: SC_ERR_INITIALIZATION(45)] - pid file '/var/run/suricata.pid' exists. Is Suricata already running? Aborting!<br>
<br>I tried deleting the pid file and restarting it but get the same error. I'm new to this, any help would be much appreciated!<br><br>Thanks,<br>Benson<br><br>
<br></div></div>_______________________________________________<br>
Suricata IDS Users mailing list: <a href="mailto:oisf-users@openinfosecfoundation.org" target="_blank">oisf-users@openinfosecfoundation.org</a><br>
Site: <a href="http://suricata-ids.org" target="_blank">http://suricata-ids.org</a> | Support: <a href="http://suricata-ids.org/support/" target="_blank">http://suricata-ids.org/support/</a><br>
List: <a href="https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users" target="_blank">https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users</a><br>
OISF: <a href="http://www.openinfosecfoundation.org/" target="_blank">http://www.openinfosecfoundation.org/</a><br></blockquote></div>
</blockquote></div><br>