suricata stop logging

[Stephane Balaguer]

Hi Guys,

I have a problem with one of my sensors.

The problem is only on 1 monitor interface, for few days now, the sensor didn't update some log files, in my case dns-json.log and dns.log

avril 20 09:09 stats.log
avril 20 09:09 alert-json.log
avril 20 08:56 dns-json.log
avril 20 08:56 dns.log

If i run command : nsm_sensor_ps-restart

DNS log files are correctly populated but after 1 min there is no new data.

Obviously, if i run tcpdump on this interface i can see that DNS traffic is coming well...

I have check logs file for barnyard and suricata but nothing found, I tried to reboot the server but same issue.

For second interface all files are populated correctly...

Any idea to investigate ?

Regards,
Stephane

[Wes]

Stephane,

Please provide the output of sostat-redacted, attaching as a plain text file, or using a service like Pastebin.com

Thanks,
Wes

[Stephane Balaguer]

Hi Wes,

Thanks for answer, output is attached ;-)

FYI, problem happened on interface eth7

Thanks,

Stephane

--
Follow Security Onion on Twitter!
https://twitter.com/securityonion
---
You received this message because you are subscribed to a topic in the Google Groups "security-onion" group.
To unsubscribe from this topic, visit https://groups.google.com/d/topic/security-onion/ttchNgEOTgs/unsubscribe.
To unsubscribe from this group and all its topics, send an email to security-onion+unsubscribe@googlegroups.com.
To post to this group, send email to security-onion@googlegroups.com.
Visit this group at https://groups.google.com/group/security-onion.
For more options, visit https://groups.google.com/d/optout.

[Wes Lambert]

Stephane,

I don't see much of an issue with anything from your sostat output.  I also don't think those logs are enabled hy default with Security Onion.  Do you have any issue with Bro's DNS log being updated?

Thanks,

Wes

To post to this group, send email to securit...@googlegroups.com.

Visit this group at https://groups.google.com/group/security-onion.
For more options, visit https://groups.google.com/d/optout.

--
Follow Security Onion on Twitter!
https://twitter.com/securityonion
---

You received this message because you are subscribed to the Google Groups "security-onion" group.
To unsubscribe from this group and stop receiving emails from it, send an email to security-onion+unsubscribe@googlegroups.com.

[Stephane Balaguer]

Wes,

seems to be ok for bro :
/nsm/bro/logs/current$ 255828119 avril 24 07:11 dns.log

/nsm/bro/logs/current$ date
lundi 24 avril 2017, 07:12:28 (UTC+0000)

You're right i have edited the suricata.yaml to enable these logs.

interesting thing is that i have the same problem with ssh-json.log.

I think my problem come from suircata.yaml config...

[Wes Lambert]

Stephane,

Did you back up this file before you made your changes?  Have you compared your changes for this particular interface's conif file to one that works?  Would you be able to provide the output of suricata,yaml?

Thanks,

Wes

[Stephane Balaguer]

Hi Wes,

Ok good news, problem is now fixed.

Few days ago i have modified the suricata.yaml in order to log dns traffic on interface eth7 and FW traffic for eth6. what i did is :

- modify eve-log

- added some logs :

  - eve-log:
      enabled: yes
      type: file
      filename: dns-json.log
      types:
        - dns
 
  - eve-log:
      enabled: yes
      type: file
      filename: web-json.log
      types:
        - http:
            extended: yes     # enable this for extended logging information
        - tls:
            extended: yes     # enable this for extended logging information
 
  - eve-log:
      enabled: yes
      type: file
      filename: ssh-json.log
      types:
        - ssh
 

The problem was due to copy/past that create some duplicate entries for same eve-logs.

So yesterday i get the default suricata.yaml file and i removed the part from :

line 77 (outputs:)

to :

line 928 (magic-file: /usr/share/file/magic)

and insert only eve-log needed (cf file conf attached)

so for now problem seems to fixed and i get all logs since yesterday afternoon.

I will look at suricata doc to personalize the file ;-)

Thanks,

-