<html>
<head>
<style><!--
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 12pt;
font-family:Calibri
}
--></style></head>
<body class='hmmessage'><div dir='ltr'>Peter,<div><br></div><div>I run with -vv switch and suricata.log only has this warning:</div><div><div><Warning> - [ERRCODE: SC_ERR_NOT_SUPPORTED(225)] - Eve-log support not compiled in. Reconfigure/recompile with libjansson and its development files installed to add eve-log support.</div><div><br></div><div>I assume it would be unrelated.</div><br><div>> Date: Mon, 29 Feb 2016 17:22:02 +0100<br>> Subject: Re: [Oisf-users] Suricata with PF_RING and IXGBE<br>> From: petermanev@gmail.com<br>> To: coolyasha@hotmail.com<br>> CC: oisf-users@lists.openinfosecfoundation.org<br>> <br>> On Mon, Feb 29, 2016 at 3:52 PM, Yasha Zislin <coolyasha@hotmail.com> wrote:<br>> > I have a weird problem. I have a bunch of sensors running in CentOS 6 with<br>> > latest pf_ring and Suricata 2.1beta4.<br>> > Most of the sensors have HP fiber nics (10 gigs) for monitoring interfaces<br>> > but two of them have Intel 82599 (ixgbe).<br>> > One of these Intel sensors is active and the other is standby. Standby<br>> > barely has any traffic on monitored interface (about 400 packets a minute<br>> > which are all broadcast).<br>> > When I start suricata service on the standby, it is impossible to reload<br>> > rules or to stop it. On stop it eventually dies off with this message:<br>> <br>> When you start Suricata on the standby sensor - is there any err in<br>> the suricata.log (when using the -v switch)?<br>> <br>> > <Error> - [ERRCODE: SC_ERR_FATAL(171)] - Engine unable to disable detect<br>> > thread - "RxPFReth21". Killing engine<br>> ><br>> > I've flipped the active and standby to check if the server/hardware is the<br>> > problem. The issue moved to the other server when it became standby.<br>> ><br>> > I've installed the latest Intel Driver. I've set everything on it as per<br>> > article:<br>> > http://pevma.blogspot.com/2013/12/suricata-and-grand-slam-of-open-source.html<br>> ><br>> > I've tried killing irqbalance and setting affinity. No luck.<br>> > I did however noticed that if i reduce number of threads to 1, everything is<br>> > working. But when it is more than one, the issue starts.<br>> ><br>> > Did anybody else have this issue with Intel cards and PF_RING???<br>> ><br>> > _______________________________________________<br>> > Suricata IDS Users mailing list: oisf-users@openinfosecfoundation.org<br>> > Site: http://suricata-ids.org | Support: http://suricata-ids.org/support/<br>> > List: https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users<br>> > Suricata User Conference November 9-11 in Washington, DC:<br>> > http://oisfevents.net<br>> <br>> <br>> <br>> -- <br>> Regards,<br>> Peter Manev<br></div></div> </div></body>
</html>