Possible bug report: wrong loglevel naming in config generation leads to incorrect suricata.yaml

F90

The symptom was all suricata interfaces not starting anymore and producing no logs beside one "starting" info in the syslog.
Executing

/usr/local/bin/suricata -i ixl0 -c /usr/local/etc/suricata_1827_ixl0/suricata.yaml

brought up

<ERROR> - [ERRCODE: SC_ERR_INVALID_ARGUMENT(13)] - Invalid Log level: err

In the config outputs.syslog.level was set to "err". changing it to "error" manually and rerunning the command worked fine.
This value was set through the Web-GUI under Global Settings -> General Settings -> Log Priority.
The dropdown menu offers the value ERR, which when selected leads to the above behaviour.
The Error is 100% reproducible by switching between ERR and some other value.
This was double checked by testing on following versions:

pfsense CE 2.7.0 Stable Release + suricata 6.0.13
pfsense CE 2.6.0 Stable Release + suricata 6.0.4_1

What do you think, is there some mistake on my side I could have missed, or is this a bug in the suricata package?
If it is, where am I supposed to file an issue?

Thanks in advance
Laurenz

bmeeks

Sounds like perhaps the values the Suricata binary expects to see for that parameter in suricata.yaml might have changed since that area of code was originally written.

I will check into it, and if necessary, include a fix in the next package update. I have several identified issues to clean up, but waiting a few more days to see what else might be reported.

Thank you for the report.

bmeeks

This issue is corrected in a forthcoming package update. I've posted a Pull Request for review and merging by the Netgate developer team here: https://github.com/pfsense/FreeBSD-ports/pull/1313. Look for a new 7.0.2 package version to appear soon.