Incorrect synchronization of suricata rules

[Cantondy]

Hello,

I use Security onion in distributed architecture.
When creating custom rules for Suricata, there are strange errors synchronizing the created rules.

Let me explain:

• If I delete a rule, it remains active and continues to generate alerts (first alert on the image below).
• If I modify a rule, I end up with 2 rules with the same ID but not the same configuration (1st and 2nd alert on the image below).

I create the alerts via the GUI in the “Detection” tab, then perform a “differentiale update” to synchronize the rules.

What am I doing wrong? I don't understand this behavior and it's hell to test and debug custom rules.

Thanks in advance for all your answers!