bond0 interface created manually but suricata still using interface eno2

[Gregg3]

Installed a Sensor (Forward Node) on physical server from the 2.3.190 iso. During installation, I asked it to monitor traffic on all the interfaces except for the management interface. For some reason, it didn't create bond0. Suricata was only capturing packets from interface eno2. I've manually created bond0 and run so-setup-network. Even tried manually editing the suricata.yaml and the onion2_sensor.sls but nothing that I've tried has been effective. Suricata is still listening on only eno2.

Maybe I made a mistake in adding bond0 with this command:
sudo nmcli con add type bond con-name bond0 ifname bond0 mode 0

What am I doing wrong?

[robbiemarshall]

Try running this command and see if that fixes the issue:

nmcli con up bond0-slave-eno2

[Gregg3]

Thanks for the suggestion. That command made the interfaces look like what I would expect... but still only getting data from eno2.

I've tried manually editing some configuration files to change eno2 to bond0, but that doesn't seem to have any effect.
Maybe the answer is to configure a separate suricata to handle each network interface?

[Gregg3]

In the Onion <Manager/Search>, I can modify /opt/so/saltstack/local/pillar/minions/_sensor.sls - and then restart suricata on . This allows me to change the interface from eno2 to eno3, but when I change it to bond0, suricata captures nothing.

[Gregg3]

We decided to give up on getting suricata to capture from multiple interfaces using bond0. Configured the Cisco switch to combine the interfaces onto one 10G interface. Suricata is now monitoring that traffic using ens3f0.

So, for us, this is a closed issue.
Thanks for the assistance.