Hi, [...]
9/5/2022 -- 14:20:21 - <Error> -- [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - Complete IP space negated. Rule address range is NIL. Probably have a !any or an address range that supplies a NULL address range
This seems to indicate that in the rule below, the expression ![$SMTP_SERVERS,$DNS_SERVERS] (most likely) negates the whole IP space. So this depends on what was set in these variables in your suricata.conf. How did you configure those? For example, when at least one of these is set to "any" then this situation will occur.
Please note that Suricata is unlikely to work "out of the box" without any additional configuration that tailors the installation to your system (e.g. at least setting monitoring interfaces, etc.) which is _not_ done when installing the Debian package.
Best regards Sascha
