diff --git a/config/rootfiles/core/142/filelists/files b/config/rootfiles/core/142/filelists/files
index 11daea4b5..de55da9c8 100644
--- a/config/rootfiles/core/142/filelists/files
+++ b/config/rootfiles/core/142/filelists/files
@@ -5,6 +5,7 @@ var/ipfire/langs
 etc/unbound/unbound.conf
 etc/rc.d/helper/aws-setup
 etc/rc.d/helper/azure-setup
+etc/rc.d/init.d/suricata
 etc/rc.d/init.d/unbound
 etc/suricata/suricata.yaml
 lib/udev/network-hotplug-bridges
diff --git a/src/initscripts/system/suricata b/src/initscripts/system/suricata
index 29e58a7e2..f0d4b88d1 100644
--- a/src/initscripts/system/suricata
+++ b/src/initscripts/system/suricata
@@ -190,7 +190,10 @@ case "$1" in
 		# Flush firewall chain.
 		flush_fw_chain
 
-		# Remove suricata control socket.              
+		# Sometimes suricata not correct shutdown. So killall.
+		killall -KILL /usr/bin/suricata 2>/dev/null
+
+		# Remove suricata control socket.
 		rm /var/run/suricata/* >/dev/null 2>/dev/null
 
 		# Trash remain pid file if still exists.