Version: VyOS 2026.09.16-0028-rolling (amd64), CPU: Intel Xeon E5420 (no SSE4.2/AVX)

Summary: The Suricata shipped in the image crashes immediately with SIGILL on CPUs that lack SSE4.2. systemd keeps restarting the service until Start request repeated too quickly, leaving a failed state, log spam and CPU burn.

Evidence:

• systemctl show -p NRestarts --value suricata -> 5
• suricata.service: Control process exited, code=killed, status=4/ILL
• suricata.service: Failed with result 'signal'.
• suricata.service: Scheduled restart job, restart counter is at 5.
• suricata.service: Start request repeated too quickly.

Expected: a clear failure message stating that the CPU lacks the required instruction set, and no restart loop (or a ConditionCPUFeature in the unit).

Impact: log spam + CPU burn on older x86 hardware; users must manually disable the service.