Suricata not limiting log sizes by default
-
Although the default setting in Suricata is to have log management enabled and per log size limits defined that does not appear to be applied at install.
Those tags do not appear in the config file unless the Log Management tab is saved in the GUI.
As a result the Suricata logs can quickly fill /var if it's a RAM drive.
I tested this on a fresh 2.4.3 install today but it would be good to see it confirmed.
Steve
-
Ugh, yes, we found this out the hard way today when a client's SG-3100's 7 GB drive filled up (showed 109% full...). Fortunately I could SSH in and delete the 6.5 GB log file, but still had to restore the configuration.
Can we please have log rotation enabled by default?
Edit: I just got what you said...you're saying it is on by default when the Suricata package is installed, but if you don't save the Logs Management tab it will revert to not rotating the logs, on the first boot?
Edit: re: confirmation, found this on two other client routers as well.
-
Can you, or someone, create a bug in https://redmine.pfsense.org/projects/pfsense-packages? Apparently I cannot create new bugs there, though I did once in the past.
-
Yes, though usually attracting the attention of @bmeeks is the best way to get traction on this.
Steve
