Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.bugs.dist > #1279854 > unrolled thread

Bug#1126405: suricata: breaks logrotate if suricata is disabled

Back to article view | Back to linux.debian.bugs.dist

This discussion starts older than the indexed window; earlier articles aren't shown. The article labeled Started by below is the oldest one visible, not the original post.

Contents

  Bug#1126405: suricata: breaks logrotate if suricata is disabled Andreas Dolp <dev@andreas-dolp.de> - 2026-01-26 20:50 +0100
    Bug#1126405: suricata: breaks logrotate if suricata is disabled Andreas Dolp <dev@andreas-dolp.de> - 2026-01-27 19:50 +0100
    Bug#1126405: suricata: breaks logrotate if suricata is disabled Alban Browaeys <alban.browaeys@gmail.com> - 2026-01-28 22:20 +0100
      Bug#1126405: suricata: breaks logrotate if suricata is disabled Andreas Dolp <dev@andreas-dolp.de> - 2026-01-29 07:40 +0100

#1279854 — Bug#1126405: suricata: breaks logrotate if suricata is disabled

[Multipart message — attachments visible in raw view] — view raw

Control: tags -1 +confirmed
Control: found -1 suricata/2.0.8-1
Control: severity -1 minor

Hi Alban,

thanks for reporting this.

I could reproduce this behaviour on a current Debian trixie with 
suricata/1:7.0.10-1+deb13u2.

To do so, I started suricata to generate some logfiles like the eve.json 
and then stopped it by `systemctl stop suricata`. Running `logrotate 
--force /etc/logrotate.conf` led to the error (`cat: 
/var/run/suricata.pid: No such file or directory`) as you stated, so I 
think I can confirm this as a bug.

According to the git history, the postrotate-line was introduced in 
de06e0eb [3], which was suricata/2.0.8-1 and it's even there in the 
current unstable suricata/1:8.0.3-1.

For unstable I will do a fix in accordance to the upstream docs about 
logrotate, see [1], so that we get a little closer to the upstream 
recommendations.

Because this is probably of severity minor [2], there will be no fix for 
trixie. As a workaroud, the postrotate command from the upstream docs 
can be used in an individual logrotate config.

Best regards,
Andreas

[1] https://docs.suricata.io/en/suricata-8.0.3/output/log-rotation.html
[2] https://www.debian.org/Bugs/Developer#severities
[3] 
https://salsa.debian.org/pkg-suricata-team/pkg-suricata/-/commit/de06e0eb

[toc] | [next] | [standalone]

#1279947

[Multipart message — attachments visible in raw view] — view raw

Control: tags -1 +pending

Hello,

this bug is now fixed in unstable [1] and will be part of the next 
release or upload.
Thanks again for reporting.

Regards,
Andreas

[1] 
https://salsa.debian.org/pkg-suricata-team/pkg-suricata/-/commit/312da107b9cd09948ad1635bd5362611d4f08d78

[toc] | [prev] | [next] | [standalone]

#1280063

[Multipart message — attachments visible in raw view] — view raw

Le 26 janvier 2026 20:32:26 GMT+01:00, Andreas Dolp <dev@andreas-
dolp.de> a écrit :
>Control: tags -1 +confirmed
>Control: found -1 suricata/2.0.8-1
>Control: severity -1 minor
>
>Hi Alban,
>
>thanks for reporting this.
>
>I could reproduce this behaviour on a current Debian trixie with
suricata/1:7.0.10-1+deb13u2.
>
>To do so, I started suricata to generate some logfiles like the
eve.json and then stopped it by `systemctl stop suricata`. Running
`logrotate --force /etc/logrotate.conf` led to the error (`cat:
/var/run/suricata.pid: No such file or directory`) as you stated, so I
think I can confirm this as a bug.
>
>According to the git history, the postrotate-line was introduced in
de06e0eb [3], which was suricata/2.0.8-1 and it's even there in the
current unstable suricata/1:8.0.3-1.
>
>For unstable I will do a fix in accordance to the upstream docs about
logrotate, see [1], so that we get a little closer to the upstream
recommendations.

Agreed even if I prefer not to run a command unnecessarily. I've if the
profile does not exists the kill command should not run instead of
running it but ignoring it's error. But it should be discussed with
upstream to get the doc changed or kept as is if no agreement. So fine
with me about this upstream fix.


>
>Because this is probably of severity minor [2], there will be no fix
for trixie. As a workaroud, the postrotate command from the upstream
docs can be used in an individual logrotate config.

I disagree with this being a minor bug. Indeed it is minor for suricata
itself. But it breaks logrotate completely. As far as I understand no
further log rotation happens after this error. Log rotate is dead. So
it might breaks other packages. This is not minor. Please revert the
severity.


>Best regards,
>Andreas
>
>[1]
https://docs.suricata.io/en/suricata-8.0.3/output/log-rotation.html
>[2] https://www.debian.org/Bugs/Developer#severities
>[3]
https://salsa.debian.org/pkg-suricata-team/pkg-suricata/-/commit/de06e0eb
>

[toc] | [prev] | [next] | [standalone]

#1280071

[Multipart message — attachments visible in raw view] — view raw

Hi Alban,
thanks for your reply.


 > Agreed even if I prefer not to run a command unnecessarily. I've if 
the profile does not exists the kill command should not run instead of 
running it but ignoring it's error. But it should be discussed with 
upstream to get the doc changed or kept as is if no agreement. So fine 
with me about this upstream fix.

You're right. I will see if I can find the time to address this 
upstream. But for now OK with that.


 > I disagree with this being a minor bug. Indeed it is minor for 
suricata itself. But it breaks logrotate completely. As far as I 
understand no further log rotation happens after this error. Log rotate 
is dead. So it might breaks other packages. This is not minor. Please 
revert the severity.

Yes, I agree with you. For Suricata itself, this bug is severity minor, 
as it 'doesn't affect the package's usefulness, and is presumably 
trivial to fix' [2]. So far so good.

For logrotate it would be quite higher, _if_ it completely breaks 
logrotate - I absolutely agree with that.
But _does_ it break logrotate completely?
How did you come to this finding?

I did a short test in a trixie VM with suricata/1:7.0.10-1+deb13u2 and 
an unfixed logrotate config:
- Renaming '/etc/logrotate.d/suricata' to 
'/etc/logrotate.d/01_suricata', because logrotate executes configs in 
alphabetical order [1], so if that breaks, no other rotates will be done.
- Enforce logrotation by 'sudo logrotate -f -v /etc/logrotate.conf'
- For my test, logrotate _does_ rotate the other logs and exits with 
code 1. So yes, it affects logrotate indirectly, but it does not affect 
any other rotations or packages.

Which other tests did you do to completely fail logrotate?

Don't get me wrong, it's not about doing the stable fix, but we have to 
find some reason why this is really of serverity 'important' to even get 
the update agreed in the next point release.

Regards,
Andreas

[1] https://manpages.debian.org/trixie/logrotate/logrotate.8.en.html#include
[2] https://www.debian.org/Bugs/Developer#severities

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.bugs.dist

csiph-web