Suricata DNS messages being cut off

  • Hi all

    I am beginning to play with Suricata on my pfsense box and am noticing some messages are being cut off when I view the system logs ( I am sending the suricata logs to the system logs with hope to ship them off to ELK later). below is an example of what I am seeing.


  • I think I recall seeing a bug report on the Suricata Redmine site about the DNS analyzer truncating some metadata. Not 100% sure about that, but it does ring a bell of some type.

    If you have all of the EVE JSON output enabled, then check those log files. They will be located in the /var/log/suricata path. In that path you will find a sub-directory for each configured interface.

Log in to reply