<![CDATA[Suricata seems to function but not showing blocks/alerts reliably]]>I've seen this a couple times over the years and usually resolved with a reinstall of suricata from package manager. This week it isn't working.

So it seems to be functioning normally, but the blocks/alerts log files keep getting blanked out. Any page like the alerts or blocks that is supposed to show blocks or alerts shows nothing usually upon loading the page...then a few ... then nothing again at the next refresh.

Anybody got ideas on what is nuking the list?

]]>https://forum.netgate.com/topic/196664/suricata-seems-to-function-but-not-showing-blocks-alerts-reliablyRSS for NodeSun, 13 Sep 2026 02:19:48 GMTSat, 08 Mar 2025 01:57:32 GMT60<![CDATA[Reply to Suricata seems to function but not showing blocks/alerts reliably on Sat, 08 Mar 2025 04:27:15 GMT]]>@skogs Sometimes, it takes a village. :)

]]>https://forum.netgate.com/post/1208674https://forum.netgate.com/post/1208674Sat, 08 Mar 2025 04:27:15 GMT<![CDATA[Reply to Suricata seems to function but not showing blocks/alerts reliably on Sat, 08 Mar 2025 04:24:37 GMT]]>There was one single fat file in there. I'm curious if it is simply triggering the combined log directory size limit. For giggles I deleted the logs manually and fired it back up. Seems to have made it beyond the 5 minute mark at least.

I spent some quality time looking at normal log rotation stuff before posting. I didn't even think to look at the logs strictly to consider size. Oops.

]]>https://forum.netgate.com/post/1208672https://forum.netgate.com/post/1208672Sat, 08 Mar 2025 04:24:37 GMT<![CDATA[Reply to Suricata seems to function but not showing blocks/alerts reliably on Sat, 08 Mar 2025 04:06:58 GMT]]>@SteveITS
Staring at /var/log/suricata/suricata_igcxxxxx does indeed confirm the alerts.log and block.log getting nuked every 5 minutes.
Just a little excessive and I'm not quite sure where it is coming from.

]]>https://forum.netgate.com/post/1208671https://forum.netgate.com/post/1208671Sat, 08 Mar 2025 04:06:58 GMT<![CDATA[Reply to Suricata seems to function but not showing blocks/alerts reliably on Sat, 08 Mar 2025 02:28:03 GMT]]>@skogs Suricata log rotation? There’s a total space setting too as I recall…

]]>https://forum.netgate.com/post/1208668https://forum.netgate.com/post/1208668Sat, 08 Mar 2025 02:28:03 GMT