Suricata

Please try removing the -D from the Suricata command line. You should not run it as a daemon when using systemd.

Jason Ish wrote:

Please try removing the -D from the Suricata command line. You should not run it as a daemon when using systemd.

I am running Ubuntu 18.04.3 and I copied Ubuntu distributed suricata systemd startup service and ran my own built suricata binary from suricata github tree, it has "-D" in the systemd, I have no problem, maybe something not right in Centos 7.x ?

here is mine

[Unit]
Description=Suricata IDS/IDP daemon
After=network.target network-online.target
Requires=network-online.target
Documentation=man:suricata(8) man:suricatasc(8)
Documentation=https://redmine.openinfosecfoundation.org/projects/suricata/wiki

[Service]
Type=forking
#Environment=LD_PREDLOAD=/usr/lib/libtcmalloc_minimal.so.4
PIDFile=/var/run/suricata.pid
ExecStart=/usr/bin/suricata -D --af-packet -c /etc/suricata/suricata.yaml --pidfile /var/run/suricata.pid
ExecReload=/usr/bin/suricatasc -c reload-rules ; /bin/kill -HUP $MAINPID
ExecStop=/usr/bin/suricatasc -c shutdown
Restart=on-failure
ProtectSystem=full
ProtectHome=true

[Install]
WantedBy=multi-user.target

Setting the service to forking is another option as well. But the template systemd unit file that comes with Suricata does not do this, and does not expect Suricata to daemonize.

I think you should enable -D option in systemd because when I omit that -D, suricata won't run. This is for suricata v6.0

For systemd this is working perfectly:

[Unit]
Description=Suricata IDS/IDP Service
Wants=network.target syslog.target
After=network.target syslog.target
Documentation=man:suricata(8) man:suricatasc(8)
Documentation=https://redmine.openinfosecfoundation.org/projects/suricata/wiki

[Service]
Type=forking
ExecStart=suricata --af-packet -vvv -D -c /etc/suricata/suricata.yaml --pidfile /var/run/suricata.pid
ExecStartPre=rm -f /var/run/suricata.pid
ExecReload=kill -USR2 $MAINPID

[Install]
WantedBy=multi-user.target