Project

General

Profile

Support #3134

rule reload sometimes not working in worker runmode

Added by John Smith about 2 months ago. Updated 20 days ago.

Status:
Closed
Priority:
Normal
Assignee:
Target version:
Affected Versions:
Effort:
Difficulty:
Label:

Description

When I set the runmode as workers and I use this command 'kill -USR2 $(pidof suricata)' to reload rules.But sometimes suricata doesn't reload rules.
If I change workers mode to autofp and use 'kill -USR2 $(pidof suricata)'.There is no problems.
So I want to know the way to solve this problem.Thank you!

History

#1

Updated by Andreas Herz about 2 months ago

  • Status changed from New to Feedback
  • Assignee changed from Victor Julien to OISF Dev
  • Target version set to Support

Can you give us more details about your setup?
What version of suricata are you running on what system?
Do you see the rule reload started message at least in the suricata.log?
I saw some cases where the rule reload got stuck.

#2

Updated by John Smith about 1 month ago

ok,there are my steps:
(1) suricata -c /etc/suricata/suricata.yaml -q 0 -q 1 -q 2
(2) kill -USR2 $(pidof suricata)
And the suricata version is 4.0.5,the system is Ubuntu16.04 server.
Then I still use this command 'kill -USR2 $(pidof suricata)',maybe wait 2s,5s or 10s but there are rules reload messages.
And if I use the reload command frequently,sometimes suricata doesn't reload rules and there is no reloa message.

#3

Updated by Victor Julien about 1 month ago

Can you try 4.1.4? We did a fix in the 4.1.x series.

#4

Updated by John Smith about 1 month ago

ok,I will try the 4.1.4.Thank you.

#5

Updated by Victor Julien 20 days ago

  • Subject changed from The worker mode to rule reload something not working in worker runmode
  • Status changed from Feedback to Closed
#6

Updated by Victor Julien 20 days ago

  • Subject changed from rule reload something not working in worker runmode to rule reload sometimes not working in worker runmode

Also available in: Atom PDF