Suricata no longer generating alerts #13274
-
Version2.4.80 Installation MethodSecurity Onion ISO image Descriptionother (please provide detail below) Installation TypeDistributed Locationon-prem with Internet access Hardware SpecsExceeds minimum requirements CPU12 RAM128gb Storage for /300gb Storage for /nsm32tb Network Traffic Collectionspan port Network Traffic SpeedsLess than 1Gbps StatusYes, all services on all nodes are running OK Salt StatusNo, there are no failures LogsNo, there are no additional clues DetailHi, I upgraded yesterday to version 2.4.80 and it seems like Suricata is no longer throwing any alerts anymore (it is worth noting I also purged old docker containers as well), I'm not too sure what has happened. At first, I tried rebooting the whole distributed setup I have (Search, Manager, Forward, and Receiver). This caused Kibana & Elastic to error 404 on me, after waiting for around ~30 minutes, it still was erroring with a 404 so I gave the manager a quick reboot and it came back online. However, the original problem persisted and Suricata was still not generating any alerts. I ran On the manager I had a look at The Suricata log on the forward node can be found below: The PCAPS are all still being generated, as you can see below by looking at the timestamps: I did however try to look for the I checked the following directory on the forward node: Looking at the Suricata log file, this line is interesting: Like I said above though, I had a look at the I even had a look at the output of the It seems like there is no timer on this script that runs so it's just around 800k+ lines like that. So I done this command: Where is it finding this file?? Is this file being removed as soon as it's created? Hence why I'm getting no alerts? But wouldn't Suricata then throw in the log that eve.json doesn't exist? Am I missing something? As you can see, any help would be appreciated! Guidelines
|
Beta Was this translation helpful? Give feedback.
Replies: 1 comment 3 replies
-
|
It appears that you've changed from the default of stenographer pcap to suricata pcap. Please note that suricata pcap is still considered BETA: When you changed to suricata pcap, which config option did you set under Administration --> Configuration --> global --> pcapengine ( What did you set for suricata pcap maxsize under Administration --> Configuration --> suricata --> pcap --> maxsize? What is the output of the following? |
Beta Was this translation helpful? Give feedback.
-
|
Hi, Yep, it's changed to I changed to this a while ago and it was working fine until well... now. Suricata pcap Max Size is set to Output of this command According to the grid view, there's around Do you think it's the pcaps that are causing the problem of Suricata not being able to throw alerts? |
Beta Was this translation helpful? Give feedback.
-
|
It seems that Suricata is writing alerts to disk but the sensor clean script is deleting those files because it thinks you're running out of disk space. I would try lowering suricata maxsize to something smaller like Also, it looks like your old steno pcap has aged out so you should be able to switch from |
Beta Was this translation helpful? Give feedback.
-
|
Hi Doug, thanks for that. I changed it to |
Beta Was this translation helpful? Give feedback.
It seems that Suricata is writing alerts to disk but the sensor clean script is deleting those files because it thinks you're running out of disk space.
I would try lowering suricata maxsize to something smaller like
25000. Then runsudo so-checkinon the forward node and verify that it picks up the new setting. Suricata should then purge old pcap until /nsm/suripcap is down to 25T. Then see if the sensor clean script stops deleting the suricata eve log.Also, it looks like your old steno pcap has aged out so you should be able to switch from
TRANSITIONtoSURICATAto stop running steno altogether. This won't necessarily help your disk space issue but it will lower CPU and RAM usage on th…