Suricata

Dataset is not working in unix-socket mode. When a dataset (let's say ua) is defined in the yaml and when a rule is using the dataset (like doing dataset:set,ua), then Suricata fails loading when running in unix socket mode.

The reason is that DatasetsInit is called in the PreRunInit function that is called when pcap processing start. Thus at detection engine build time, the dataset is not yet defined and the rule fails to load.