After Upgrade , Suricata wont work

[danigijon92-afk]

Version

2.4.211

Installation Method

Security Onion ISO image

Description

upgrading

Installation Type

Standalone

Location

other (please provide detail below)

Hardware Specs

Exceeds minimum requirements

CPU

4

RAM

24

Storage for /

1TB

Storage for /nsm

1TB

Network Traffic Collection

span port

Network Traffic Speeds

more than 10Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

Hi,

After upgrading version, im facing this issue :

Suricata Rules:no rules configured
ElastAlert: Rule Mismatch
Strelka: Rule Mismatch
Suricata: Sync Blocked

I noticed the following on yaml , same as

#15335

I found the suricata.yaml file which has references to non-existent folders (/etc/suricata/) but changing the entries to point to /opt/so/conf/suricata/rules, saving and restarting suricata, resets the entries. Where is the config for suricata located if it's resetting that yaml? Is it all in the Docker container?

how this can be fixed?

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.

[cm-ops]

What does the syncBlock file say? https://docs.securityonion.net/en/2.4/nids.html#sync-block

[danigijon92-afk]

Hi,
I've been able to load rules after deleting that file.

I can see :

Suricata Rules:64650 loaded

I also see :

ElastAlert: [Rule Mismatch
Strelka: [Rule Mismatch]

I notice there are not alerts being generated (quite strange) , not sure if something else related.

Is there any fix for those?

Kind regards

[cm-ops]

If you click on the word rule mismatch it will pivot to Hunt, what do you see there as a reason?