Project

General

Profile

Actions

Bug #3390

closed

Eve log does not generate pcap_filename when Interacting via unix socket in pcap processing mode

Added by Ui X almost 2 years ago. Updated almost 2 years ago.

Status:
Closed
Priority:
Normal
Assignee:
Target version:
Affected Versions:
Effort:
Difficulty:
Label:

Description

When I using this command "suricata -c xxx.yaml -r xxx.pcap", the output eve-log generates pcap_filname in every line.

But when i using "suricata -c xxx.yaml --unix-socket" and 'suricatasc xxx.socket -c "pcap-file test.pcap /home/pcap/"', the output eve-log does not has "pcap_filename", the log sample is as follows:

{"timestamp":"2019-08-27T10:54:02.199286+0800","flow_id":1803132955396726,"pcap_cnt":1523,"event_type":"dns","src_ip":"10.x.x.x","src_port":64800,"dest_ip":"192.x.x.x","dest_port":53,"proto":"UDP","dns":{"type":"query","id":10166,"rrname":"xxx.com","rrtype":"A","tx_id":0}}

How can I fix this?

Actions #1

Updated by Victor Julien almost 2 years ago

  • Description updated (diff)
  • Priority changed from High to Normal
Actions #2

Updated by Victor Julien almost 2 years ago

Can you try the following patch?

diff --git a/src/output-json.c b/src/output-json.c
index 925d9664e..53b9441b7 100644
--- a/src/output-json.c
+++ b/src/output-json.c
@@ -1055,7 +1055,8 @@ OutputInitResult OutputJsonInitCtx(ConfNode *conf)
         const char *pcapfile_s = ConfNodeLookupChildValue(conf, "pcap-file");
         if (pcapfile_s != NULL && ConfValIsTrue(pcapfile_s)) {
             json_ctx->file_ctx->is_pcap_offline =
-                (RunmodeGetCurrent() == RUNMODE_PCAP_FILE);
+                (RunmodeGetCurrent() == RUNMODE_PCAP_FILE ||
+                 RunmodeGetCurrent() == RUNMODE_UNIX_SOCKET);
         }

         json_ctx->file_ctx->type = json_ctx->json_out;

Actions #3

Updated by Ui X almost 2 years ago

Victor Julien wrote:

Can you try the following patch?
[...]

It works! Thank you.

Actions #4

Updated by Victor Julien almost 2 years ago

  • Tracker changed from Support to Bug
  • Status changed from New to Assigned
  • Assignee set to Victor Julien
  • Target version set to 5.0.1
Actions

Also available in: Atom PDF