Project

General

Profile

Actions
Copy link

Feature #39

closed

Making Logging Configurable

Added by Will Metcalf over 14 years ago. Updated over 14 years ago.

Status:
Closed
Priority:
Normal
Assignee:
Jason Ish
Target version:
0.8.1
Effort:
Difficulty:
Label:

Description

On a production sensor there probably isn't a need to have alert-debug.log, fast.log, unified, unified2 logs, stats.log and http.log all being logged. The logging options should be configurable by the user via the suricata.yaml file and via command line opts. This will be assigned as task.

Files

Download all files
0001-Use-the-configuration-file-to-setup-alert-logging-an.patch (58.3 KB) 0001-Use-the-configuration-file-to-setup-alert-logging-an.patch Patch against 6b36e23e457375c9408036d85c62701a30556c6e of master. Jason Ish, 01/06/2010 03:32 PM
0001-Use-the-configuration-file-to-setup-alert-logging-an.patch (58.3 KB) 0001-Use-the-configuration-file-to-setup-alert-logging-an.patch Jason Ish, 01/06/2010 05:46 PM
0002-Configurable-alert-outputs-for-PF_RING-modes.patch (15.9 KB) 0002-Configurable-alert-outputs-for-PF_RING-modes.patch Jason Ish, 01/06/2010 05:46 PM
0003-configurable-outputs-for-nfq-and-pcap-file.patch (14.2 KB) 0003-configurable-outputs-for-nfq-and-pcap-file.patch Jason Ish, 01/06/2010 05:46 PM
Actions
Copy link
 #1

Updated by Jason Ish over 14 years ago

The following patch allows the alert outputs to be configured with the configuration file. One important note about the thread model is that all outputs run in the same thread now which is a little different from the current IdsPcap2 mode where most of the alert outputs are in their own thread.

The other modes will be updated as well in incremental patches to this.

An example of the configuration is:

outputs:

- fast:
      enabled: yes
      filename: fast.log
- unified-log:
      enabled: yes
      filename: unified.log

And you can specify the same output multiple times, but you would want to give them their own filename.

Actions
Copy link
 #3

Updated by Jason Ish over 14 years ago

  • Status changed from New to Resolved

These patches are now in the master.

Actions
Copy link
 #4

Updated by Will Metcalf over 14 years ago

  • Status changed from Resolved to Closed
Actions
Copy link

Also available in: Atom PDF