Project

General

Profile

Feature #2935

Support for multiple-logger for drop eve-log

Added by Ruben Louis 5 months ago. Updated 5 months ago.

Status:
New
Priority:
Normal
Target version:
Effort:
Difficulty:
Label:

Description

Hello according to the documetation, https://github.com/OISF/suricata/blob/d6903e70c1b653984ca95f8808755efbc6a9ece4/doc/userguide/output/eve/eve-json-output.rst#multiple-logger-instances, one cannot have multiple-logger instances for the drop eve-log.
Is this something that could be implemented?

History

#1

Updated by Victor Julien 5 months ago

  • Assignee set to Community Ticket
  • Target version set to TBD

The issue is that the tracking of the flow logging 'flows: all|start' is done using a flag in the flow. Since the first logger would set the flag, the 2nd would not log as the flag is already set. Working around this is not impossible but would require some thought.

Also available in: Atom PDF