Project

General

Profile

Actions
Copy link

Bug #7497

closed

pcap: exit with errors when running with -r and --pcap-file-continuous

Added by Ofer Dagan 7 months ago. Updated 22 days ago.

Status:
Closed
Priority:
Normal
Assignee:
Lukas Sismis
Target version:
7.0.11
Affected Versions:
7.0.8, 7.0.11
Effort:
Difficulty:
Label:

Description

Hi,
I'm trying to run suricata as follows:

suricata -r /tmp/pcaps/ --pcap-file-continuous --pcap-file-delete -vvvv

It shows the following logs and then exits:
Info: pcap: Processing pcaps directory /tmp/pcaps/, files must be newer than 0 and older than 1705604840362 [PcapDirectoryDispatch:source-pcap-file-directory-helper.c:497]
Info: pcap: Processing pcaps directory /tmp/pcaps/, files must be newer than 0 and older than 1705604845362 [PcapDirectoryDispatch:source-pcap-file-directory-helper.c:497]
Info: pcap: Processing pcaps directory /tmp/pcaps/, files must be newer than 0 and older than 1705604850363 [PcapDirectoryDispatch:source-pcap-file-directory-helper.c:497]
Error: threads: thread "FM#01" failed to start in time: flags 0003 [TmThreadWaitOnThreadRunning:tm-threads.c:1832]

This issue was already addressed here - https://forum.suricata.io/t/suricata-exits-with-errors-when-running-with-r-and-pcap-file-continuous/4396.
However, it seems that it wasn't fixed (I've tested in both 7.0.2 and 7.0.8).

The suggested solution to use suricatasc is not good for me for two reasons:
1. It's problematic for me - https://redmine.openinfosecfoundation.org/issues/7283.
2. It seems there is another bug that once running the command it disables the 

pcap-file.delete-when-done
option (you can see this using conf-get command before and after. I've tried running it with all params, with some and nothing worked.

Thanks ahead

Related issues 1 (0 open — 1 closed)

Related to Suricata - Bug #7568: pcap: continuous file reading fails on an empty directoryClosedLukas SismisActions
Actions
Copy link

Also available in: Atom PDF