Project

General

Profile

Actions

Support #2790

closed

rule_perf.log repeating the same results

Added by Bryant Smith over 2 years ago. Updated over 2 years ago.

Status:
Closed
Priority:
Normal
Assignee:
-
Affected Versions:
Label:

Description

I just recently notice that the rule_perf.log file has been repeating the exact same results for a rule alert. I have my yaml file configured to NOT append and I also have the json output disabled. The file is overwritten but always with 6 outputs of the same event. I also have Suricata 4.0.6 install on the same VM running Ubuntu 18.04.1 LTS without this issue.

alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"Testing Signature and Rule Perf"; flow:established,to_server; content:"/forum.ghp"; http_uri; sid:11111; rev:1;)

  1. rule profiling
    rules:
    1. Profiling can be disabled here, but it will still have a
    2. performance impact if compiled in.
      enabled: yes
      filename: rule_perf.log
      append: no

--------------------------------------------------------------------------
Date: 1/23/2019 -- 10:08:37. Sorted by: ticks.
--------------------------------------------------------------------------
Num Rule Gid Rev Ticks % Checks Matches Max Ticks Avg Ticks Avg Match Avg No Match
-------- ------------ -------- -------- ------------ ------ -------- -------- ----------- ----------- ----------- --------------
1 11111 1 1 12404 100.00 1 1 12404 12404.00 12404.00 0.00

--------------------------------------------------------------------------
Date: 1/23/2019 -- 10:08:37. Sorted by: average ticks.
--------------------------------------------------------------------------
Num Rule Gid Rev Ticks % Checks Matches Max Ticks Avg Ticks Avg Match Avg No Match
-------- ------------ -------- -------- ------------ ------ -------- -------- ----------- ----------- ----------- --------------
1 11111 1 1 12404 100.00 1 1 12404 12404.00 12404.00 0.00
--------------------------------------------------------------------------
Date: 1/23/2019 -- 10:08:37. Sorted by: average ticks (match).
--------------------------------------------------------------------------
Num Rule Gid Rev Ticks % Checks Matches Max Ticks Avg Ticks Avg Match Avg No Match
-------- ------------ -------- -------- ------------ ------ -------- -------- ----------- ----------- ----------- --------------
1 11111 1 1 12404 100.00 1 1 12404 12404.00 12404.00 0.00
--------------------------------------------------------------------------
Date: 1/23/2019 -- 10:08:37. Sorted by: average ticks (no match).
--------------------------------------------------------------------------
Num Rule Gid Rev Ticks % Checks Matches Max Ticks Avg Ticks Avg Match Avg No Match
-------- ------------ -------- -------- ------------ ------ -------- -------- ----------- ----------- ----------- --------------
1 11111 1 1 12404 100.00 1 1 12404 12404.00 12404.00 0.00
--------------------------------------------------------------------------
Date: 1/23/2019 -- 10:08:37. Sorted by: number of checks.
--------------------------------------------------------------------------
Num Rule Gid Rev Ticks % Checks Matches Max Ticks Avg Ticks Avg Match Avg No Match
-------- ------------ -------- -------- ------------ ------ -------- -------- ----------- ----------- ----------- --------------
1 11111 1 1 12404 100.00 1 1 12404 12404.00 12404.00 0.00
--------------------------------------------------------------------------
Date: 1/23/2019 -- 10:08:37. Sorted by: number of matches.
--------------------------------------------------------------------------
Num Rule Gid Rev Ticks % Checks Matches Max Ticks Avg Ticks Avg Match Avg No Match
-------- ------------ -------- -------- ------------ ------ -------- -------- ----------- ----------- ----------- --------------
1 11111 1 1 12404 100.00 1 1 12404 12404.00 12404.00 0.00
--------------------------------------------------------------------------
Date: 1/23/2019 -- 10:08:37. Sorted by: max ticks.
--------------------------------------------------------------------------
Num Rule Gid Rev Ticks % Checks Matches Max Ticks Avg Ticks Avg Match Avg No Match
-------- ------------ -------- -------- ------------ ------ -------- -------- ----------- ----------- ----------- --------------
1 11111 1 1 12404 100.00 1 1 12404 12404.00 12404.00 0.00

=====Suricata 4.1.2 Build=====
./configure --prefix=/opt/suricata-4.1.2 --sysconfdir=/opt/suricata-4.1.2/etc/ --localstatedir=/opt/suricata-4.1.2/var/ --enable-luajit \
--with-libnss-libraries=/usr/lib --with-libnss-includes=/usr/include/nss/ --with-libnspr-libraries=/usr/lib \
--with-libnspr-includes=/usr/include/nspr --with-libluajit-includes=/usr/local/include/luajit-2.0/ \
--with-libluajit-libraries=/usr/lib/ \
--enable-profiling \
--enable-rust

This is Suricata version 4.1.2 RELEASE
Features: PCAP_SET_BUFF AF_PACKET HAVE_PACKET_FANOUT LIBCAP_NG LIBNET1.1 HAVE_HTP_URI_NORMALIZE_HOOK PCRE_JIT HAVE_NSS HAVE_LUA HAVE_LUAJIT HAVE_LIBJANSSON PROFILING TLS MAGIC RUST
SIMD support: SSE_4_2 SSE_4_1 SSE_3
Atomic intrisics: 1 2 4 8 16 byte(s)
64-bits, Little-endian architecture
GCC version 7.3.0, C version 199901
compiled with _FORTIFY_SOURCE=2
L1 cache line size (CLS)=64
thread local storage method: __thread
compiled with LibHTP v0.5.29, linked against LibHTP v0.5.29

Suricata Configuration:
AF_PACKET support: yes
eBPF support: no
XDP support: no
PF_RING support: no
NFQueue support: no
NFLOG support: no
IPFW support: no
Netmap support: no
DAG enabled: no
Napatech enabled: no
WinDivert enabled: no

Unix socket enabled:                     yes
Detection enabled: yes
Libmagic support:                        yes
libnss support: yes
libnspr support: yes
libjansson support: yes
liblzma support: yes
hiredis support: no
hiredis async with libevent: no
Prelude support: no
PCRE jit: yes
LUA support: yes, through luajit
libluajit: yes
libgeoip: no
Non-bundled htp: no
Old barnyard2 support: no
Hyperscan support: no
Libnet support: yes
liblz4 support: yes
Rust support:                            yes
Rust strict mode: no
Rust debug mode: no
Rust compiler: rustc 1.30.0
Rust cargo: cargo 1.30.0
Install suricatasc:                      yes
Install suricata-update: no
Profiling enabled:                       yes
Profiling locks enabled: no

Development settings:
Coccinelle / spatch: no
Unit tests enabled: no
Debug output enabled: no
Debug validation enabled: no

Generic build parameters:
Installation prefix: /opt/suricata-4.1.2
Configuration directory: /opt/suricata-4.1.2/etc/suricata/
Log directory: /opt/suricata-4.1.2/var/log/suricata/

--prefix                                 /opt/suricata-4.1.2
--sysconfdir /opt/suricata-4.1.2/etc
--localstatedir /opt/suricata-4.1.2/var
--datarootdir /opt/suricata-4.1.2/share
Host:                                    x86_64-pc-linux-gnu
Compiler: gcc (exec name) / gcc (real)
GCC Protect enabled: no
GCC march native enabled: yes
GCC Profile enabled: no
Position Independent Executable enabled: no
CFLAGS -g -O2 -march=native -I${srcdir}/../rust/gen/c-headers
PCAP_CFLAGS -I/usr/include
SECCFLAGS

Files

2018-9059.pcap (5.93 KB) 2018-9059.pcap Bryant Smith, 01/23/2019 05:05 PM
Actions #1

Updated by Victor Julien over 2 years ago

The outputs are not the same. They are each sorted by a different column. Not very useful with a single rule, but I think it's not worth adding an exception for just a single rule.

Actions #2

Updated by Bryant Smith over 2 years ago

Well I'm an idiot. All I had to do was read the next few lines in the yaml file. Sorry about that and thanks for pointing it out.

  1. Sort options: ticks, avgticks, checks, matches, maxticks
    • * # If commented out all the sort options will be used.**
      #sort: avgticks
Actions #3

Updated by Victor Julien over 2 years ago

  • Tracker changed from Bug to Support
  • Status changed from New to Closed
Actions

Also available in: Atom PDF