You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Describe the bug
Trying to understand issues with Suricata (still not unclear, the only relevant log is pcap_next_ex(): -2), I've found out two small issues - Suricata reports missing additional config files:
[32 - Suricata-Main] 2024-09-13 13:20:18 Warning: classification-config: could not open: "/etc/suricata/classification.config": No such file or directory
[32 - Suricata-Main] 2024-09-13 13:20:18 Error: classification-config: please check the "classification-file" option in your suricata.yaml file
[32 - Suricata-Main] 2024-09-13 13:20:18 Error: reference-config: Error opening file: "/etc/suricata/reference.config": No such file or directory
[32 - Suricata-Main] 2024-09-13 13:20:18 Error: reference-config: please check the "reference-config-file" option in your suricata.yaml file
After verifying config generated by the AL service and the file system, it's turned out files exist, but in the /usr/local/etc/suricata/ directory, while the config points to the /etc/.
To Reproduce
Steps to reproduce the behavior:
Start suricata service
Connect to the container console and read log from /usr/local/var/log/suricata/suricata.log
Expected behavior
This is an open question. The fix is trivial, but my question to Suricata & AL experts is: does it matter? Does it change anything in how AL treats the results, or if Suricata is successful in the analysis?
The Suricata documentation points that it helps to better understand the purpose of rules, but maybe AL just does not use it and thus, it's an intentional misconfiguration?
Screenshots
Environment (please complete the following information if pertinent):
Assemblyline Version: 4.5.0.45
Suricata service: 4.5.0.34
Additional context
The text was updated successfully, but these errors were encountered:
kam193
added
assess
We still haven't decided if this will be worked on or not
bug
Something isn't working
labels
Sep 13, 2024
Describe the bug
Trying to understand issues with Suricata (still not unclear, the only relevant log is
pcap_next_ex(): -2
), I've found out two small issues - Suricata reports missing additional config files:After verifying config generated by the AL service and the file system, it's turned out files exist, but in the
/usr/local/etc/suricata/
directory, while the config points to the/etc/
.To Reproduce
Steps to reproduce the behavior:
/usr/local/var/log/suricata/suricata.log
Expected behavior
This is an open question. The fix is trivial, but my question to Suricata & AL experts is: does it matter? Does it change anything in how AL treats the results, or if Suricata is successful in the analysis?
The Suricata documentation points that it helps to better understand the purpose of rules, but maybe AL just does not use it and thus, it's an intentional misconfiguration?
Screenshots
Environment (please complete the following information if pertinent):
Additional context
The text was updated successfully, but these errors were encountered: