202-203: Suricata logging error, IPS not starting

Installing & Running IPFire Update Trouble
1

After update from 202 to 203 (it seems the IPS was NOT on in this system, which is strange, but that may itself be an error) the IPS would not start. The error was:

 [7063] <Error> -- unable to initialize sub-module eve-log.stats
 [7063] <Error> -- eve.stats: stats are disabled globally: set stats.enabled to true. See https://docs.suricata.io/en/suricata-8.0.5/configuration/suricata-yaml.html#stats

In suricata.yaml, global stats was set to no:

# Global stats configuration
stats:
  enabled: no

…but eve-log was set to yes:

  # Extensible Event Format (nicknamed EVE) event log in JSON format
  - eve-log:
      enabled: yes

Setting eve-log to no allowed the IPS to start. Still, this points to some upgrade script snafu.

I’m not sure I should report this as a bug, if no one else has seen this :smiley:

2

The standard entries I have in mine are that stats, fast and eve-log are all enabled.

The eve-log was included related to the suricata reporting function that was added a while back.

I have just checked 3 of my 6 systems and all three nof those have the three logs set to
enabled: yes

The only ref to suricata in the update.sh script is to restart it after the update.

https://git.ipfire.org/?p=ipfire-2.x.git;a=blob;f=config/rootfiles/core/203/update.sh;h=5b314664fc59a4491384733f1aadf146c06a3b41;hb=refs/heads/core203#l125

You could also look in your CU203 update log file
/var/log/pakfire/update-core-upgrade-203.log
and see if there is anything in there related to suricata.