<html>
<head>
<style><!--
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 12pt;
font-family:Calibri
}
--></style></head>
<body class='hmmessage'><div dir='ltr'>I have been observing the following issue on multiple Suricata sensors.<div>When SPAN/TAP port has 0 packets and small amount of broadcast packets, Suricata has issues. It hangs. If you try to do a rule-reload, it gets hang up on the last step where it says complete. Here is a few lines from suricata.log</div><div><div>14/12/2015 -- 09:39:00 - <Info> - building signature grouping structure, stage 1: preprocessing rules... complete</div><div>14/12/2015 -- 09:39:01 - <Info> - building signature grouping structure, stage 2: building source address list... complete</div><div>14/12/2015 -- 09:49:51 - <Info> - building signature grouping structure, stage 3: building destination address lists... complete</div><div><span style="font-size: 12pt;">14/12/2015 -- 09:50:54 - <Info> - Threshold config parsed: 71 rule(s) found</span></div><div>14/12/2015 -- 09:50:54 - <Notice> - rule reload starting</div><div>14/12/2015 -- 09:50:54 - <Info> - Live rule swap has swapped 15 old det_ctx's with new ones, along with the new de_ctx</div></div><div><br></div><div>It is supposed to say rule reload complete in the end.</div><div>After this rule reload, CPU load on Suricata is almost non-existent. I assume that means that it doesnt inspect or maybe because there is no load since not much traffic present.</div><div><br></div><div>So after this reload fails. I cannot stop suricata until a kill the process.</div><div>I am running CentOS 6 64 bit with suricata 2.1 beta4.</div><div>I have not tried Suricata 3.0RC.</div><div><br></div><div>I am curious to see if there is a way to fix that on my current version.</div><div><br></div><div>Thank you.</div> </div></body>
</html>