Suricata - log management option not set on fresh install

Graham.Collinson

It looks as though the log management option isn't set on a fresh install. 'enable_log_mgmt' isn't set in the config anywhere but the default when viewing the log management tab in the gui has this option ticked.

Is this something that needs to be included in suricata_migrate_config.php?

bmeeks

Log management is something that is left disabled by default as some users may want to keep all logs for an indefinite amount of time. Granted this is not the best choice, but I thought it better to allow each admin to decide for themselves.

If the option is showing as "default enabled" on the LOG MGMT tab, then it is possibly the result of checking for the wrong value "on" versus "yes", for example. I've fixed some of those in the distant past I believe.

Edit: yep, I took a quick look in the PHP source for the suricata_logs_mgmt.php file and see a logic error in this line:

// Grab saved settings from configuration
$pconfig['enable_log_mgmt'] = config_get_path('installedpackages/suricata/config/0/enable_log_mgmt') == 'off' ? 'off' : 'on';

That line should instead read like this:

// Grab saved settings from configuration
$pconfig['enable_log_mgmt'] = config_get_path('installedpackages/suricata/config/0/enable_log_mgmt') == 'on' ? 'on' : 'off';

The incorrect line will interpret "blank" or an empty parameter the same as "on" when it should instead interpret anything other than an explicit "on" string the same as "off". I will create a Redmine Issue for this and also add it to my internal TODO list.

bmeeks

Here is the Redmine Issue for this bug: https://redmine.pfsense.org/issues/15744.

Thank you for reporting it.