<html>
<head>
<style><!--
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 12pt;
font-family:Calibri
}
--></style></head>
<body class='hmmessage'><div dir='ltr'>Almost correct. Suricata is running but promiscuous mode is disabled on monitored interface which is a SPAN port.<br>So in that state, if I try to restart or stop Suricata with kill -15 1234 (where 1234 is the PID of Suricata), it will throw this error.<br><br>The problem with OS Clustering, is that Suricata service would have to be restarted. <br><br>My goal is to have 0 loss in monitoring. If I have Suricata running on Stand By node, then it could be quick to flip them.<br><br>If there are no ideas, I'll have to think more about this.<br><br>Thanks for the input.<br><br><div>> Date: Mon, 7 Jul 2014 21:42:53 +0200<br>> Subject: Re: [Oisf-users] Suricata Clustering<br>> From: petermanev@gmail.com<br>> To: coolyasha@hotmail.com<br>> CC: oisf-users@lists.openinfosecfoundation.org<br>> <br>> On Mon, Jul 7, 2014 at 9:36 PM, Yasha Zislin <coolyasha@hotmail.com> wrote:<br>> > Has anybody worked with Clustering multiple Suricata nodes to provide High<br>> > Availability and Fault Tolerance?<br>> ><br>> > I have two Suricata nodes and was thinking about implementing Active/Standby<br>> > cluster. After some research I came up with the following idea.<br>> > Have standby Suricata disable promiscuous mode on monitoring NICs (SPAN<br>> > Ports). This way Suricata is running and I can (using a script) enable<br>> > promiscuous mode and have my monitoring.<br>> ><br>> > Here are the issues:<br>> > - Suricata doesnt work well when SPAN port nics have promiscious mode<br>> > disabled. For example, when trying to stop it (or restart it) it hangs but<br>> > eventually crashes with error ( <Error> - [ERRCODE: SC_ERR_FATAL(171)] -<br>> > Engine unable to disable detect thread - "RxPFReth02". Killing engine)<br>> > - Suricata live rule reload doesnt work. It just hangs there forever.<br>> <br>> <br>> The above described issue could be experienced when Suricata is<br>> stopped and there is no traffic on the mirror port.<br>> Is that the case?<br>> <br>> ><br>> > Is there a way to tell Suricata (without restarting its service) not to<br>> > store alerts on disk (ie unified2.alert)? Maybe that way it would be<br>> > considered standby and no alerts will be generated even though it sees all<br>> > of the traffic.<br>> <br>> I think if you are looking for "clustering solution" you should do<br>> that on the OS level... much easier and more flexible.<br>> <br>> ><br>> > Thanks.<br>> ><br>> > _______________________________________________<br>> > Suricata IDS Users mailing list: oisf-users@openinfosecfoundation.org<br>> > Site: http://suricata-ids.org | Support: http://suricata-ids.org/support/<br>> > List: https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users<br>> > OISF: http://www.openinfosecfoundation.org/<br>> <br>> <br>> <br>> -- <br>> Regards,<br>> Peter Manev<br></div> </div></body>
</html>