From owner-freebsd-questions@freebsd.org Thu Jul 22 15:16:27 2021 Return-Path: Delivered-To: freebsd-questions@mailman.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.nyi.freebsd.org (Postfix) with ESMTP id 7588265ECA7 for ; Thu, 22 Jul 2021 15:16:27 +0000 (UTC) (envelope-from mike@sentex.net) Received: from pyroxene2a.sentex.ca (pyroxene19.sentex.ca [IPv6:2607:f3e0:0:3::19]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (2048 bits) client-digest SHA256) (Client CN "pyroxene.sentex.ca", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4GVwyf6Ysjz3PrC for ; Thu, 22 Jul 2021 15:16:26 +0000 (UTC) (envelope-from mike@sentex.net) Received: from [IPv6:2607:f3e0:0:4:9d91:2cc1:c790:1f3d] ([IPv6:2607:f3e0:0:4:9d91:2cc1:c790:1f3d]) by pyroxene2a.sentex.ca (8.16.1/8.15.2) with ESMTPS id 16MFGQOR091799 (version=TLSv1.3 cipher=TLS_AES_128_GCM_SHA256 bits=128 verify=NO); Thu, 22 Jul 2021 11:16:26 -0400 (EDT) (envelope-from mike@sentex.net) To: Carlos Lopez Cc: "freebsd-questions@freebsd.org" References: <2B994648-59D6-4F68-B4C8-0D8FB1CA5B87@outlook.com> <04839bf2-1d6b-1d46-3ac1-02a561d72d58@sentex.net> From: mike tancsa Subject: Re: Suricata 6.0.3 process never stops under FreeBSD 13-p3 Message-ID: <199770f2-a996-32ea-9334-f2dad6972b14@sentex.net> Date: Thu, 22 Jul 2021 11:16:26 -0400 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:78.0) Gecko/20100101 Thunderbird/78.12.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Content-Language: en-US X-Rspamd-Queue-Id: 4GVwyf6Ysjz3PrC X-Spamd-Bar: - Authentication-Results: mx1.freebsd.org; dkim=none; dmarc=none; spf=pass (mx1.freebsd.org: domain of mike@sentex.net designates 2607:f3e0:0:3::19 as permitted sender) smtp.mailfrom=mike@sentex.net X-Spamd-Result: default: False [-1.87 / 15.00]; TO_DN_EQ_ADDR_SOME(0.00)[]; TO_DN_SOME(0.00)[]; R_SPF_ALLOW(-0.20)[+ip6:2607:f3e0::/32]; HFILTER_HELO_IP_A(1.00)[pyroxene2a.sentex.ca]; HFILTER_HELO_NORES_A_OR_MX(0.30)[pyroxene2a.sentex.ca]; NEURAL_HAM_SHORT(-0.77)[-0.767]; RCPT_COUNT_TWO(0.00)[2]; FREEMAIL_TO(0.00)[outlook.com]; FROM_EQ_ENVFROM(0.00)[]; MIME_TRACE(0.00)[0:+]; RBL_DBL_DONT_QUERY_IPS(0.00)[2607:f3e0:0:3::19:from]; ASN(0.00)[asn:11647, ipnet:2607:f3e0::/32, country:CA]; MID_RHS_MATCH_FROM(0.00)[]; RCVD_IN_DNSWL_LOW(-0.10)[2607:f3e0:0:3::19:from]; ARC_NA(0.00)[]; NEURAL_HAM_MEDIUM(-1.00)[-1.000]; FREEFALL_USER(0.00)[mike]; FROM_HAS_DN(0.00)[]; NEURAL_HAM_LONG(-1.00)[-1.000]; MIME_GOOD(-0.10)[text/plain]; R_DKIM_NA(0.00)[]; DMARC_NA(0.00)[sentex.net]; SPAMHAUS_ZRD(0.00)[2607:f3e0:0:3::19:from:127.0.2.255]; TO_MATCH_ENVRCPT_SOME(0.00)[]; RCVD_COUNT_TWO(0.00)[2]; RCVD_TLS_ALL(0.00)[]; MAILMAN_DEST(0.00)[freebsd-questions] X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 22 Jul 2021 15:16:27 -0000 On 7/22/2021 9:41 AM, Carlos Lopez wrote: > > >> On 22 Jul 2021, at 15:37, mike tancsa > > wrote: >> >> On 7/21/2021 3:33 AM, Carlos Lopez wrote: >>> Good morning, >>> >>> I have installed Suricata 6.0.3 under FreeBSD 13-p3 host from source >>> using the following comp=C3=ACle options: >>> >>> ./configure --prefix=3D/opt/suricata --sysconfdir=3D/etc >>> --localstatedir=3D/var --disable-gccmarch-native --enable-profiling >>> --enable-profiling-locks --enable-netmap --enable-pie --enable-rust >>> --enable-gccprotect --disable-suricata-update. >>> >>> All works ok except when I try to stop suricata process: >>> >> I have the same problem, but also have a problem with the daemon no >> longer generating alerts. It will work for a few min to hours and then= >> it just stops.=C2=A0 Apart from the graceful shutdown, does it actuall= y work >> for you for any long period of time ? >> >> =C2=A0=C2=A0=C2=A0 =E2=80=94Mike >> > > Hi MIke, > > =C2=A0In my case, Suricata triggers alerts, detects anomaly traffic, sh= ow > statistics, etc =E2=80=A6 all It seems to work ok, except when I am try= ing to > stop the daemon. > > =C2=A0I am using virtue Nic drivers and autofp as a runmode option. > > =C2=A0IMO problem is related to this > issue:=C2=A0https://redmine.openinfosecfoundation.org/issues/4478 > > Thanks, that sure sounds like the problem I am seeing in issue 4478. It looks like both netmap and non netmap modes shows the problem :(=C2=A0 Wh= at nic drivers are you using ? I was testing both in a VM and on actual hardware and had the same results on RELENG_12 and RELENG_11 using igb NI= Cs =C2=A0=C2=A0=C2=A0 ---Mike > >