Project

General

Profile

Actions

Feature #1851

closed

add verbosity level description to the help command

Added by Peter Manev almost 6 years ago. Updated over 2 years ago.

Status:
Closed
Priority:
Normal
Assignee:
Target version:
Effort:
medium
Difficulty:
low
Label:

Description

In essence -

suricata -h 

should have the extra verbosity added/described in the help menu so that it is clearer when used on the command line.

-v info
-vv info + perf
-vvv info + perf + config

The very same values:

info perf config

can be used to be configured in suricata.yaml:
  - file:
      enabled: yes
      level: info


Related issues

Related to Bug #3210: Individual output log levels capped by the default log levelClosedJason IshActions
Actions #1

Updated by Andreas Herz almost 6 years ago

  • Assignee set to OISF Dev
  • Target version set to TBD
Actions #2

Updated by Victor Julien over 5 years ago

  • Assignee changed from OISF Dev to Andreas Herz
  • Target version changed from TBD to 70
Actions #3

Updated by Victor Julien over 5 years ago

  • Status changed from New to Assigned
Actions #4

Updated by Andreas Herz almost 5 years ago

I added that for the manpage and help command (PR done) but with the config I'm not sure what we want to have. The log level setting in the config won't take affect at all unless I use at least "-v" but it will never log more then added with "-v[vv]", so adding "config" as log level in the setting won't change the logfile output unless I also use "-vvv". But if I use "perf" as log level in the config and use "-vvv" I don't see the Config ouput in the logfile but in the stdout from the terminal where I start suricata. Looks like it's not what you might expect as user. IMHO the config setting should always affect the log level of the logfile and be seperated from the "-v[vv]" argument for the stdout output. Suggestions?

Actions #5

Updated by Peter Manev almost 5 years ago

How about if we take the approach of command line override - if it is specified on the command line - it should override the config setting - aka "-vvv" should result in max verbosity.

Actions #6

Updated by Andreas Herz over 4 years ago

The PR was https://github.com/inliniac/suricata/pull/2877 but looks like we still need to define some parts. I'm a bit confused (see my post above as well) how we want those different settings (config and commandline) and levels to work.

Actions #7

Updated by Andreas Herz almost 4 years ago

  • Status changed from Assigned to New
  • Assignee changed from Andreas Herz to OISF Dev
  • Target version changed from 70 to TBD
  • Effort set to medium
  • Difficulty set to low

We still need to discuss/decide this :)

Actions #8

Updated by Victor Julien over 3 years ago

  • Assignee changed from OISF Dev to Anonymous
Actions #9

Updated by Andreas Herz about 3 years ago

  • Assignee set to Community Ticket
Actions #10

Updated by Shivani Bhardwaj almost 3 years ago

Is this still relevant? Can I take this up?

Actions #11

Updated by Jason Ish over 2 years ago

It sounds like we have to define what make sense and what the behaviour should be, then make sure the code matches that.

I'd like to recommend that -v, or multiple -v's only increase the verbosity, but to fixed levels. But will never decrease the verbosity set in the configuration file. For example:

-v -> info
-vv -> perf
-vvv -> config
-vvvv -> debug

(hmm, of note, I think config should come before perf but thats another topic)

This should change the verbosity level for any enabled output, but will never decrease the verbosity level. For example, if I have the file output enabled with level set to config, -v or -vv will not reset it to info or perf. However, -vvvv will set it to debug.

So -v is not an increase of whatever the configured level is as suggested in a PR which can be confusing to document.

-h output:

    -v[vvvv]                             : be more verbose (use multiple times to increase verbosity)

And in the manual we could do something like:

.. option:: -v

   Increase the verbosity of the Suricata application output by
   increasing the log level.

   - -v: INFO
   - -vv: PERF
   - -vvv: CONFIG
   - -vvvv: DEBUG (if enabled)

   This option will not make the log level less verbose than
   configured in your suricata.yaml.

Actions #12

Updated by Victor Julien over 2 years ago

I agree. Think this is a large code change? If possible it would be nice to get this into 5.0, but if it is too intrusive we can push it back.

Actions #13

Updated by Jason Ish over 2 years ago

  • Status changed from New to Assigned
  • Assignee changed from Community Ticket to Jason Ish
  • Target version changed from TBD to 5.0.0

Victor Julien wrote:

I agree. Think this is a large code change? If possible it would be nice to get this into 5.0, but if it is too intrusive we can push it back.

I don't think its very large at all. I'm willing to give it a couple hours, then if I'm wrong, avoid spending too much time on it until after 5.0.

Actions #14

Updated by Jason Ish over 2 years ago

  • Related to Bug #3210: Individual output log levels capped by the default log level added
Actions #15

Updated by Jason Ish over 2 years ago

  • Status changed from Assigned to Closed
Actions

Also available in: Atom PDF