Project

General

Profile

Actions

Feature #893

closed

feature, put more info in the "drop.log"

Added by JP Pozzi about 9 years ago. Updated over 7 years ago.

Status:
Closed
Priority:
Normal
Assignee:
Target version:
Effort:
Difficulty:
Label:

Description

Hello,

I am trying Suricata as IPS and I lack some informations in the "drop.log" file.
I think that the file should contain, at least, the SID of the activated rule.

Regards

JP P

Actions #1

Updated by Victor Julien about 9 years ago

  • Status changed from New to Assigned
  • Assignee set to Eric Leblond
  • Target version set to TBD

As the log is in netfilter's log format, additions would have to stay compatible. Maybe we can mimic netfilters 'log prefix' field to add sid info. Also, it's not always a sid that causes a drop, the stream engine can drop things as well when in 'inline' mode.

Actions #2

Updated by JP Pozzi about 9 years ago

Hello,

The idea to mimic --log-prefix seems nice as it is in the "standard".

Regards

Actions #3

Updated by outrageous uproar over 8 years ago

Also, it's not always a sid that causes a drop, the stream engine can drop things as well when in 'inline' mode.

Let put at least name of engine here. How can I find what is a cause of drop?

Actions #4

Updated by Victor Julien over 7 years ago

  • Status changed from Assigned to Closed
  • Assignee changed from Eric Leblond to Victor Julien
  • Target version changed from TBD to 3.0RC1
  • % Done changed from 0 to 100

Sid is now optionally added to the eve drop log.

Actions #5

Updated by Victor Julien over 7 years ago

  • Target version changed from 3.0RC1 to 2.1beta4
Actions

Also available in: Atom PDF