Actions
Bug #2452
closed
OD
After some time log only alerts with linktype=12
Bug #2452:
After some time log only alerts with linktype=12
Affected Versions:
Effort:
Difficulty:
Label:
Description
Looks like suricata start not working correctly after some time.
I have handmade logparser, that receives eve-log via socket and store logs.
It have check for linktype 1, because I want to parse Ethernet Header and what it contains.
After start suricata and parser works correctly (I used that combination for mounts)
But now, I stuck with problem, that after some time I didn't gettin any alerts to store, because all of they have linktype12.
I.e. I started suricata ~10 hours ago, and for last 3 hours it didn't catch normal alerts, but more than hundred with linktype==12.
In previous hours suricata works correctly and generated many alerts.
Attach start logs with -vvv flag.
Files
Actions