Suricata needs SIGUSR2 to reload rules

edeca commented 6 years ago

As per the documentation, Suricata uses SIGUSR2 to signal when rules must be loaded. Sending SIGHUP is not effective. SIGUSR2 is signal number 12.

A number of options are possible:

Allow the user to specify a signal number as well as -H, though this would break if a user has Suricata (which expects USR2) and Barnyard (which expects HUP).
The config format could change for a future version, allowing the user to specify pairs of PID file/signal.
Modification could be made to function sig_hup to look for a string like suricata in the PID path and send an alternate signal. Very hacky.

aoshiken commented 6 years ago

Just FYI, take a look to the explanation by @shirkdog at PR #274

shirkdog commented 6 years ago

Closing this, let me know if the updated code from the pull request and tweaks do not work.

aoshiken commented 6 years ago

Michael, IMHO the README.md file in the root folder deserves updating its -H option... :)

shirkdog commented 6 years ago

done.

shirkdog / pulledpork