<div dir="ltr"><div>Does "stops running" mean it crashes? If so, can you get the core file?</div><div>Might not be related, but do you have SMB traffic in your network? I just stumbled upon this bug (it might be something else for you of course) <a href="https://redmine.openinfosecfoundation.org/issues/3342?issue_count=191&issue_position=1&next_issue_id=3341">https://redmine.openinfosecfoundation.org/issues/3342?issue_count=191&issue_position=1&next_issue_id=3341</a></div><div><br></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Mon, Nov 18, 2019 at 5:48 AM Leonard Jacobs <<a href="mailto:leonard.jacobs@view.com">leonard.jacobs@view.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div lang="EN-US">
<div class="gmail-m_1500929262262267005WordSection1">
<p class="MsoNormal">Ever since we went to Suricata 5.0.0, our installation randomly stops and we have to restart Suricata. At first, we thought the script that starts Suricata was failing but we manually start it at a command line and experience the same
issue.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Running Suricata on Ubuntu 18.04 with 350 GB SSD, Xeon processor, and 8 GB of RAM. Suricata is configured to just listen to network traffic on one gig ethernet port.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">How can I find out what is causing this problem?<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Thanks.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal" style="margin-bottom:12pt"><b><span style="font-family:"Century Gothic",sans-serif;color:rgb(51,99,124)">Leonard</span></b><span style="color:black"><u></u><u></u></span></p>
</div>
<br><br><p style="font-family:Verdana;font-size:10pt;color:rgb(102,102,102)"></p><p style="font-family:Verdana;font-size:8pt;color:rgb(102,102,102)">This message and any attachments may contain confidential information of View, Inc. If you are not the intended recipient you are hereby notified that any dissemination, copying or distribution of this message, or files associated with this message, is strictly prohibited. If you have received this message in error, please notify us immediately by replying to the message and delete the message from your computer.</p></div>
_______________________________________________<br>
Suricata IDS Users mailing list: <a href="mailto:oisf-users@openinfosecfoundation.org" target="_blank">oisf-users@openinfosecfoundation.org</a><br>
Site: <a href="http://suricata-ids.org" rel="noreferrer" target="_blank">http://suricata-ids.org</a> | Support: <a href="http://suricata-ids.org/support/" rel="noreferrer" target="_blank">http://suricata-ids.org/support/</a><br>
List: <a href="https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users" rel="noreferrer" target="_blank">https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users</a><br>
<br>
Conference: <a href="https://suricon.net" rel="noreferrer" target="_blank">https://suricon.net</a><br>
Trainings: <a href="https://suricata-ids.org/training/" rel="noreferrer" target="_blank">https://suricata-ids.org/training/</a></blockquote></div>