Added by Tiago F. about 5 years ago. Updated about 5 years ago.
Description
How to reproduce:
Add
sources:
- A
- B
- C
Run suricata-update.
Edit update.yaml and remove "B". On next run, suricata-update will still fetch the removed (from update.yaml) source.
Expected behavior: suricata-update should consider entries that were removed from update.yaml as sources that should be removed/disabled.
Can you run the 'list-enabled-sources' command? Maybe the same source was added/enabled with the add-source or enable-source command which does not store its configuration in update.yaml.
Jason Ish wrote:
Can you run the 'list-enabled-sources' command? Maybe the same source was added/enabled with the add-source or enable-source command which does not store its configuration in update.yaml.
Hey Jason,
That was exactly it. I incorrectly assumed update.yaml was going to take precedence over everything, but like you mentioned, as soon as I listed the sources, I was given sources from both locations (update.yaml and suricata-update itself).
Thank you!