Project

General

Profile

Actions

Bug #7497

open

Suricata exits with errors when running with -r and –pcap-file-continuous

Added by Ofer Dagan 5 days ago.

Status:
New
Priority:
Normal
Assignee:
Target version:
Affected Versions:
Effort:
Difficulty:
Label:

Description

Hi,
I'm trying to run suricata as follows:

suricata -r /tmp/pcaps/ --pcap-file-continuous --pcap-file-delete -vvvv

It shows the following logs and then exits:
Info: pcap: Processing pcaps directory /tmp/pcaps/, files must be newer than 0 and older than 1705604840362 [PcapDirectoryDispatch:source-pcap-file-directory-helper.c:497]
Info: pcap: Processing pcaps directory /tmp/pcaps/, files must be newer than 0 and older than 1705604845362 [PcapDirectoryDispatch:source-pcap-file-directory-helper.c:497]
Info: pcap: Processing pcaps directory /tmp/pcaps/, files must be newer than 0 and older than 1705604850363 [PcapDirectoryDispatch:source-pcap-file-directory-helper.c:497]
Error: threads: thread "FM#01" failed to start in time: flags 0003 [TmThreadWaitOnThreadRunning:tm-threads.c:1832]

This issue was already addressed here - https://forum.suricata.io/t/suricata-exits-with-errors-when-running-with-r-and-pcap-file-continuous/4396.
However, it seems that it wasn't fixed (I've tested in both 7.0.2 and 7.0.8).

The suggested solution to use suricatasc is not good for me for two reasons:
1. It's problematic for me - https://redmine.openinfosecfoundation.org/issues/7283.
2. It seems there is another bug that once running the command it disables the

pcap-file.delete-when-done
option (you can see this using conf-get command before and after. I've tried running it with all params, with some and nothing worked.

Thanks ahead

No data to display

Actions

Also available in: Atom PDF