Anacron daily failure for suricata

[EddieA (Eddie Atherton)]

Possibly caused by the last updates.

anacron is throwing the following e-mail daily:

/etc/cron.daily/pulledpork:

Job for suricata.service invalid.

I think as a result of these messages in /var/log/messages:

Jul  1 04:35:29 Nethserver systemd: [/usr/lib/systemd/system/suricata.service:17
] Unknown lvalue 'MemoryDenyWriteExecute' in section 'Service'
Jul  1 04:35:29 Nethserver systemd: [/usr/lib/systemd/system/suricata.service:18
] Unknown lvalue 'LockPersonality' in section 'Service'
Jul  1 04:35:29 Nethserver systemd: [/usr/lib/systemd/system/suricata.service:19
] Unknown lvalue 'ProtectControlGroups' in section 'Service'
Jul  1 04:35:29 Nethserver systemd: [/usr/lib/systemd/system/suricata.service:20
] Unknown lvalue 'ProtectKernelModules' in section 'Service'
.
.
.
Jul  1 04:35:46 Nethserver systemd: Unit suricata.service cannot be reloaded because it is inactive.

Cheers.

[mrmarkuz (Markus Neuberger)]

Is the IPS active?

Job for suricata.service invalid

Pulledpork has a daily job to download rules. In this job suricata is reloaded to apply a new config but if suricata is not running you get Job for suricata.service invalid. At the end of /etc/e-smith/events/actions/nethserver-pulledpork-apply suricata is reloaded. This is called from /etc/cron.daily/pulledpork. Cron then just mails the output. I think you can ignore it. If you really don’t like it you may edit the systemctl reload suricata line at the end of /etc/e-smith/events/actions/neth…

[EddieA (Eddie Atherton)]

@mrmarkuz

Is the IPS active?

Ha, nope, as I keep tweaking the rules, get unhappy with the results, and turn it off again.

But, it still was a change in the last set of updates, as it wasn’t being reported previously.

Cheers.