SO stop showing events

[sailormoonnnnn]

Version

2.4.30

Installation Method

Security Onion ISO image

Description

configuration

Installation Type

Distributed

Location

on-prem with Internet access

Detail

the SO just stop showing logs after a few hours with the alert on influxdb "high redis memory usage" , im using SO 2.4.30

error=>{"type"=>"illegal_state_exception", "reason"=>"Pipeline processor configured for non-existent pipeline [suricata.ike]"}}

Guidelines

• I have read the above statement and can confirm my post is relevant to Security Onion 2.4.

[sailormoonnnnn]

there is around 400k unparsed redisqueue logs

[weslambert]

Could you share a few sample logs from /nsm/suricata/eve*.json, sanitizing them as necessary?

You can run a command similar to the following.

cat eve-2024-01-12-20:01.json | jq '. | select(.event_type == "ike")'