Stopping services before potentially tampering with files they use is a
more sane approach than doing the latter and hope the running service
can cope with it. Suricata, at least, reportedly doesn't.
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>