Actions
Bug #1464
closed
PM
eve.json - uncommenting extra fields - 2.1beta4
Bug #1464:
eve.json - uncommenting extra fields - 2.1beta4
Status:
Closed
Priority:
Normal
Assignee:
-
Target version:
-
Affected Versions:
Effort:
Difficulty:
Label:
Description
This is not really a bug - but more of a end user experience improvement - especially a newbie.
With the default suricata.yaml in the eve-log section - under alert:
types:
- alert:
# payload: yes # enable dumping payload in Base64
# payload-printable: yes # enable dumping payload in printable (lossy) format
# packet: yes # enable dumping of packet (without stream segments)
# http: yes # enable dumping of http fields
# tls: yes # enable dumping of tls fields
if you just uncomment/enable the outputs it will lead to an err :
<Error> - [ERRCODE: SC_ERR_CONF_YAML_ERROR(242)] - Failed to parse configuration file at line 115: did not find expected key
This is because (due to yaml syntax) you would need to uncomment/delete the pound/hash sign and the extra space after it. Once you do that - you are good to go.
Thanks
Actions