Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Suricata DNS messages being cut off

    IDS/IPS
    2
    2
    121
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • D
      dj1635
      last edited by

      Hi all

      I am beginning to play with Suricata on my pfsense box and am noticing some messages are being cut off when I view the system logs ( I am sending the suricata logs to the system logs with hope to ship them off to ELK later). below is an example of what I am seeing.

      Suricata.PNG

      1 Reply Last reply Reply Quote 0
      • bmeeksB
        bmeeks
        last edited by

        I think I recall seeing a bug report on the Suricata Redmine site about the DNS analyzer truncating some metadata. Not 100% sure about that, but it does ring a bell of some type.

        If you have all of the EVE JSON output enabled, then check those log files. They will be located in the /var/log/suricata path. In that path you will find a sub-directory for each configured interface.

        1 Reply Last reply Reply Quote 0
        • First post
          Last post
        Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.