Actions
Bug #780
closedSuricata fails to load any of threshold rules if at least one of them is not parseable
Affected Versions:
Effort:
Difficulty:
Label:
Description
It seems that if one of the threshold rules contains type and Suricata is unable to parse it, none of the threshold rules is loaded (my peek into sourcecode seems to confirm this). Things are especially confusing if the typo is in the last rule, since Suricata is logging number of rules processed (including the failed one).
Example (failed! note the by_stc in the second line):
suppress gen_id 1, sig_id 2200029, track by_dst, ip fe80::/16
suppress gen_id 1, sig_id 2200029, track by_stc, ip fe80::/16
Expected outcome:
Suricata will still use correctly parsed threshold rules even in case the later one fails to parse. Possibly even skipping the offended rule and continue with the parsing with next line.
Actions