Added by JP Pozzi over 12 years ago. Updated almost 11 years ago.
Description
Hello,
I am trying Suricata as IPS and I lack some informations in the "drop.log" file.
I think that the file should contain, at least, the SID of the activated rule.
Regards
JP P
As the log is in netfilter's log format, additions would have to stay compatible. Maybe we can mimic netfilters 'log prefix' field to add sid info. Also, it's not always a sid that causes a drop, the stream engine can drop things as well when in 'inline' mode.
Hello,
The idea to mimic --log-prefix seems nice as it is in the "standard".
Regards
Also, it's not always a sid that causes a drop, the stream engine can drop things as well when in 'inline' mode.
Let put at least name of engine here. How can I find what is a cause of drop?
Sid is now optionally added to the eve drop log.