Suricata floods system log
-
Hi!
I have setup Suricata for my both WAN connections with pretty standard settings. Added some rules and it works as supposed. But suddenly my main system log gets flooded by log entries from Suricata. Even those that are suppressed.
I can't find any solution to disable this. Only complete disable logging in Suricata, but then I dont see any blocks in the firewall log. Any ideas?
-
Suricata will only log to the system log if you set it to do so otherwise it uses it's own logs.
It's an option in the global settings tab:
Steve
-
But this first happend last night and I didn‘t change anything.
Does it still show blocks in the pfSense firewall log if I disable this logging? -
That setting makes no difference to the firewall log it only affects Suricata logs in the System log.
You can still see the Suricata logs by going to the logs tab in Services > Suricata.
Steve
