Suricata DNS messages being cut off
dj1635 last edited by
I am beginning to play with Suricata on my pfsense box and am noticing some messages are being cut off when I view the system logs ( I am sending the suricata logs to the system logs with hope to ship them off to ELK later). below is an example of what I am seeing.
bmeeks last edited by
I think I recall seeing a bug report on the Suricata Redmine site about the DNS analyzer truncating some metadata. Not 100% sure about that, but it does ring a bell of some type.
If you have all of the EVE JSON output enabled, then check those log files. They will be located in the
/var/log/suricatapath. In that path you will find a sub-directory for each configured interface.