Suricata seems to function but not showing blocks/alerts reliably
-
I've seen this a couple times over the years and usually resolved with a reinstall of suricata from package manager. This week it isn't working.
So it seems to be functioning normally, but the blocks/alerts log files keep getting blanked out. Any page like the alerts or blocks that is supposed to show blocks or alerts shows nothing usually upon loading the page...then a few ... then nothing again at the next refresh.
Anybody got ideas on what is nuking the list?
-
@skogs Suricata log rotation? There’s a total space setting too as I recall…
-
@SteveITS
Staring at /var/log/suricata/suricata_igcxxxxx does indeed confirm the alerts.log and block.log getting nuked every 5 minutes.
Just a little excessive and I'm not quite sure where it is coming from. -
There was one single fat file in there. I'm curious if it is simply triggering the combined log directory size limit. For giggles I deleted the logs manually and fired it back up. Seems to have made it beyond the 5 minute mark at least.
I spent some quality time looking at normal log rotation stuff before posting. I didn't even think to look at the logs strictly to consider size. Oops.
-
@skogs Sometimes, it takes a village. :)