Project

General

Profile

Actions
Copy link

Feature #1191

open
PG CT

EVE log does not support customformat

Feature #1191: EVE log does not support customformat

Added by Paul Gofran almost 12 years ago. Updated about 7 years ago.

Status:
New
Priority:
Normal
Assignee:
Community Ticket
Target version:
TBD
Effort:
low
Difficulty:
medium
Label:

Description

HTTP logging with EVE log does not support the customformat tag. It would be beneficial to have consistent features between EVE logging and regular http-log which does support the customformat tag.

This is similar to #1150 where tls.store can not be used with EVE log.

VJ Updated by Victor Julien almost 12 years ago Actions
Copy link
 #1

Does this do what you need? https://github.com/inliniac/suricata/pull/956

It allows for extra logging of http headers, although it's limited to a hardcoded list currently: https://github.com/inliniac/suricata/pull/956/files#diff-544ba33b2a4e8950a3c135a9717f319dR130

PG Updated by Paul Gofran almost 12 years ago Actions
Copy link
 #2

A few things that we would like to see in addition to this are some of the things identified in #602:
Cookie parsing: ex "%{Foobar}C"
Max length: ex: "%[100]{Referer}i"

Also I did not see User-Agent in this list.
If HTTP_FIELD_SIZE could be broken up into request size and response size that would also be helpful.

VJ Updated by Victor Julien almost 12 years ago Actions
Copy link
 #3

  • Tracker changed from Bug to Feature

UA is printed to the log by default. On the rest: sensible requests :)

AH Updated by Andreas Herz over 10 years ago Actions
Copy link
 #4

  • Assignee set to OISF Dev
  • Target version set to TBD

VJ Updated by Victor Julien almost 8 years ago Actions
Copy link
 #5

  • Assignee changed from OISF Dev to Anonymous
  • Effort set to low
  • Difficulty set to medium

AH Updated by Andreas Herz about 7 years ago Actions
Copy link
 #6

  • Assignee set to Community Ticket
Actions
Copy link

Also available in: PDF Atom