Project

General

Profile

Actions
Copy link

Bug #3390

closed

Eve log does not generate pcap_filename when Interacting via unix socket in pcap processing mode

Added by Ui X about 5 years ago. Updated about 5 years ago.

Status:
Closed
Priority:
Normal
Assignee:
Victor Julien
Target version:
5.0.1
Affected Versions:
5.0.0
Effort:
Difficulty:
Label:

Description

When I using this command "suricata -c xxx.yaml -r xxx.pcap", the output eve-log generates pcap_filname in every line.

But when i using "suricata -c xxx.yaml --unix-socket" and 'suricatasc xxx.socket -c "pcap-file test.pcap /home/pcap/"', the output eve-log does not has "pcap_filename", the log sample is as follows:

{"timestamp":"2019-08-27T10:54:02.199286+0800","flow_id":1803132955396726,"pcap_cnt":1523,"event_type":"dns","src_ip":"10.x.x.x","src_port":64800,"dest_ip":"192.x.x.x","dest_port":53,"proto":"UDP","dns":{"type":"query","id":10166,"rrname":"xxx.com","rrtype":"A","tx_id":0}}

How can I fix this?

Actions
Copy link

Also available in: Atom PDF