Google Groups no longer supports new Usenet posts or subscriptions. Historical content remains viewable.
Dismiss

systemd: How to get suricata started at boot?

1,219 views
Skip to first unread message

Hans

unread,
May 3, 2017, 5:40:05 AM5/3/17
to
Hello all,

I have installed suricata on my system, but it will not start at boot.

When I manually start it, it is working well.

As the document advises, I copied /lib/systemd/system/suricata.service to
/etc/systemd/system/suricata.service and tested with

systemctl start suricata.service

"ps -aux | grep suricata" showed me the running process. But after reboot, the
process is not started automatically. As init is no more supported by
suricata, but systemd, how can I add this service into systemd, so that it is
started automatically at boot? I am still not quite experienced with systemd.

Thanks for any hints.

Best

Hans

Michael Biebl

unread,
May 3, 2017, 7:00:04 AM5/3/17
to
Am 03.05.2017 um 11:11 schrieb Hans:
> Hello all,
>
> I have installed suricata on my system, but it will not start at boot.
>
> When I manually start it, it is working well.
>
> As the document advises, I copied /lib/systemd/system/suricata.service to
> /etc/systemd/system/suricata.service and tested with

You only need to copy suricata.service to /etc if you want to change its
contents. Even then, often drop-in snippets are preferrable, which only
override/extend the parts you need

> systemctl start suricata.service
>
> "ps -aux | grep suricata" showed me the running process. But after reboot, the
> process is not started automatically. As init is no more supported by
> suricata, but systemd,

The suricata package still ships a SysV init script, but if a systemd
service file exists, it takes precedence.

how can I add this service into systemd, so that it is
> started automatically at boot? I am still not quite experienced with systemd.

systemctl enable suricata.service

will do the trick. That should be done by the package though.
I see you already filed a bug report [1] for that. The package should be
using init-system-helper/dh_systemd to help automate that.


[1] https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=861732

--
Why is it that all of the instruments seeking intelligent life in the
universe are pointed away from Earth?

signature.asc

Dejan Jocic

unread,
May 3, 2017, 7:00:04 AM5/3/17
to

Hans

unread,
May 3, 2017, 7:40:06 AM5/3/17
to
Am Mittwoch, 3. Mai 2017, 12:38:39 CEST schrieb Dejan Jocic:
> On 03-05-17, Hans wrote:
> > Hello all,
> >
Hi Michael, high Dejan,

this works! But I will let the bugreport open (unless, you think it can be
closed), because the maintainer might want to look, why the installation
script in the package did not configure suricata correctly.

However, if there is no bug found, so it is here on my system gone defective
by chance, who knows.

Whatever: Thank you very much for your fast help, and Dejan, Yes, I will read
your links carefully!

Best regards

Hans
>
> Short answer:
>
> #systemctl enable suricata.service
>
> Bit longer answers and something that you should read:
>
> https://www.digitalocean.com/community/tutorials/how-to-use-systemctl-to-man
> age-systemd-services-and-units
>
> http://linoxide.com/linux-command/systemd-vs-sysvinit-cheatsheet/
>
> https://dynacont.net/documentation/linux/Useful_SystemD_commands/


--
Ullrich-IT-Consult
Ihr Partner für die Themen
* IT-SICHERHEIT * IT-SERVICE *
* LINUX * EDV-SCHULUNGEN *

Hans-J. Ullrich
Münstedter Weg 10
31246 Oberg

Tel.: 0152 287 30804
FAX: 05172 930 414

E-Mail: hans.u...@loop.de

Michael Biebl

unread,
May 3, 2017, 10:00:04 AM5/3/17
to
Am 03.05.2017 um 13:12 schrieb Hans:
> Am Mittwoch, 3. Mai 2017, 12:38:39 CEST schrieb Dejan Jocic:
>> On 03-05-17, Hans wrote:
>>> Hello all,
>>>
> Hi Michael, high Dejan,
>
> this works! But I will let the bugreport open (unless, you think it can be
> closed), because the maintainer might want to look, why the installation
> script in the package did not configure suricata correctly.
>
> However, if there is no bug found, so it is here on my system gone defective
> by chance, who knows.

It's a valid bug in the package and needs to be fixed there. Don't close it.
signature.asc

Arturo Borrero Gonzalez

unread,
May 3, 2017, 11:50:04 AM5/3/17
to
On 3 May 2017 at 12:36, Michael Biebl <bi...@debian.org> wrote:
> Am 03.05.2017 um 11:11 schrieb Hans:
>> Hello all,
>>
>> I have installed suricata on my system, but it will not start at boot.
>>
>> When I manually start it, it is working well.
>>
>> As the document advises, I copied /lib/systemd/system/suricata.service to
>> /etc/systemd/system/suricata.service and tested with
>
> You only need to copy suricata.service to /etc if you want to change its
> contents. Even then, often drop-in snippets are preferrable, which only
> override/extend the parts you need
>
>> systemctl start suricata.service
>>
>> "ps -aux | grep suricata" showed me the running process. But after reboot, the
>> process is not started automatically. As init is no more supported by
>> suricata, but systemd,
>
> The suricata package still ships a SysV init script, but if a systemd
> service file exists, it takes precedence.
>
> how can I add this service into systemd, so that it is
>> started automatically at boot? I am still not quite experienced with systemd.
>
> systemctl enable suricata.service
>
> will do the trick. That should be done by the package though.

This conflicts with what was reported in #850889 [0].

I think both arguments are valid:

1) any suricata deployment is likely to require manual configuration
before proper service. Auto-start makes no sense.
2) yes, we are debian, we like things running out of the box

So, I'm unsure what path to follow.

In any case, a fix is not landing in stretch at this point. We should
wait for the stretch stable release.

Comments/discussion welcome.

[0] https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=861732

Hans

unread,
May 3, 2017, 12:30:06 PM5/3/17
to
I suggest, if it is not wanted, to get suricata started at boot by default,
then just leave the package as it is.

However, in that case, you should mention the opportunity by systemctl in the
README.debian (or better let the user decide during install) if he wants it
running at boot or not.

I personally found the solution with systemctl, so this regardless what you
decide, IMO this bugreport can be closed.

To discuss this is a welcome decision and real open-source-thinking!

Best

Hans
0 new messages