diff --git a/qa/live/afp-ids.sh b/qa/live/afp-ids.sh
index 541ca982c1..e938e06cfe 100755
--- a/qa/live/afp-ids.sh
+++ b/qa/live/afp-ids.sh
@@ -70,8 +70,8 @@ if [ $STATSCHECK = false ]; then
     echo "ERROR no packets captured"
     RES=1
 fi
-SID1CHECK=$(jq -c 'select(.event_type == "alert")' ./eve.json | tail -n1 | jq '.alert.signature_id == 1')
-if [ $SID1CHECK = false ]; then
+SID1CHECK=$(jq -c 'select(.alert.signature_id == 1)' ./eve.json | wc -l)
+if [ $SID1CHECK -eq 0 ]; then
     echo "ERROR no alerts for sid 1"
     RES=1
 fi
diff --git a/qa/live/pcap.sh b/qa/live/pcap.sh
index 06f59ee896..8dfae07825 100755
--- a/qa/live/pcap.sh
+++ b/qa/live/pcap.sh
@@ -61,8 +61,8 @@ if [ $STATSCHECK = false ]; then
     echo "ERROR no packets captured"
     RES=1
 fi
-SID1CHECK=$(jq -c 'select(.event_type == "alert")' ./eve.json | tail -n1 | jq '.alert.signature_id == 1')
-if [ $SID1CHECK = false ]; then
+SID1CHECK=$(jq -c 'select(.alert.signature_id == 1)' ./eve.json | wc -l)
+if [ $SID1CHECK -eq 0 ]; then
     echo "ERROR no alerts for sid 1"
     RES=1
 fi