Suricata on Sensors not providing data to Master

[YvesEutelsat]

Version

2.4.70

Installation Method

Security Onion ISO image

Description

other (please provide detail below)

Installation Type

Distributed

Location

airgap

Hardware Specs

Exceeds minimum requirements

CPU

16

RAM

128G

Storage for /

1T

Storage for /nsm

350M

Network Traffic Collection

tap

Network Traffic Speeds

1Gbps to 10Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

Good day,

Within the distributed deployment, I have 11 sensors. 8 of them are giving Suricata logs back to Master. 3 of them are not giving anything back to Master.

Looking at those sensors, they are producing logs, but their size is only 4.6k /each which I find small. Looking into Kibana, those 3 sensors have an average of 11,000 count per day mostly from Zeek.

Is it because there not enough traffic on those sensors so nothing is triggering from Suricata?

Any advice on where I should look will be much appreciated.

Thanks

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.

[dougburks]

Take a look at the Troubleshooting Alerts section of the documentation:
https://docs.securityonion.net/en/2.4/suricata.html#troubleshooting-alerts