<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<span></span><span>Hello, could use your opinion on suricata issue<br>
</span>
<div> <br>
</div>
<div>Running suricata 3.0 on Centos 7.4 (3.10.0-862.14.4.el7.x86_64) Dell PowerEdge 720s, 730s<br>
</div>
<div><br>
</div>
<div>Automation pushes rules to 400+ servers where a script places them in a directory for suricata to see, then reloads the rules with this:<br>
</div>
<div> <br>
</div>
<div>kill -SIGUSR2 $(pid) ( https://media.readthedocs.org/pdf/suricata/suricata-3.2.2/suricata.pdf says "kill -USR2 pid" -- don't have USR2 on our systems!)<br>
</div>
<div><br>
</div>
<div>On most servers this reload works fine. On about 5-10 percent, reload occurs -- because it's logged -- but can see the rules did not reload. This can be seen in a file we write output to.<br>
</div>
<div><br>
</div>
<div>On servers with this issue, load is very low (logging top every minute) and vulnerabilities logged in output file is low and is not changing. No smoking gun in logs.<br>
</div>
<div><br>
</div>
<div>Thread counts vary across the grid: 6, 7, 13, 15. Lua is lua-5.1.4-15.el7.x86_64 pfring is pfring-6.4.1-4_ESG.x86_64<br>
</div>
<div><br>
</div>
<div>This reload sluggishness is generally random. The rules generally reload after several hours, but a check is performed every 10 minutes, so rules should be updating more quickly.<br>
</div>
<div><br>
</div>
<div>I call this problem "random"<br>
</div>
<div><br>
</div>
<span>Was wondering if anyone had seen this.</span><span></span>
</body>
</html>