<div dir="ltr">I figured it out later. What initially confused me, and I'll make an update to the redmine docs to clarify this, was that this was an http log so I thought I should be seeing all the http requests and http responses from the outside my internal network. When I examined the http custom logging page, I realized that there were options you could specify that checked the http status %s, headers from the http response %{}o, and so forth. So even though all the source ip addresses I see are from inside my network, Suricata also keeps track of the http responses to each http requests and you just have to specify it through the format options to make suricata display it in the logs on how the server responded.<div>
<br></div><div style>The fact that I wasn't seeing the http responses in their own separate lines was what basically confused me.</div></div><div class="gmail_extra"><br><br><div class="gmail_quote">On Sat, Feb 9, 2013 at 2:07 PM, Peter Manev <span dir="ltr"><<a href="mailto:petermanev@gmail.com" target="_blank">petermanev@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><br><br><div class="gmail_quote"><div><div class="h5">On Fri, Feb 8, 2013 at 7:43 PM, Vincent Fang <span dir="ltr"><<a href="mailto:vincent.y.fang@gmail.com" target="_blank">vincent.y.fang@gmail.com</a>></span> wrote:<br>
</div></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div><div class="h5">
<div dir="ltr">I'm examining the http.log and the configuration in the suricata.yaml and I'm noticing it's only showing requests coming from the client side but no http responses from the server being requested or http requests from external to my internal network. Is there a configuration setting that changes this?<div>
<br></div><div>I'm using a custom logging format where it shows the source ip and source port -> destination ip destination port like so for http-log in the suricata.yaml:</div><div><br></div><div>
<br></div><div>customformat: %a %p -> %A %P</div><div><br></div><div><br></div><div>Vince</div></div>
<br></div></div>_______________________________________________<br>
Suricata IDS Users mailing list: <a href="mailto:oisf-users@openinfosecfoundation.org" target="_blank">oisf-users@openinfosecfoundation.org</a><br>
Site: <a href="http://suricata-ids.org" target="_blank">http://suricata-ids.org</a> | Support: <a href="http://suricata-ids.org/support/" target="_blank">http://suricata-ids.org/support/</a><br>
List: <a href="https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users" target="_blank">https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users</a><br>
OISF: <a href="http://www.openinfosecfoundation.org/" target="_blank">http://www.openinfosecfoundation.org/</a><br></blockquote></div><br>Hi Vince,<br><br>works fine for me....:<br><br><blockquote style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex" class="gmail_quote">
192.168.1.131 40285 -> 8.27.131.126 80<br>192.168.1.131 37783 -> 157.166.255.115 80<br>192.168.1.131 40286 -> 8.27.131.126 80<br>192.168.1.131 60343 -> <a href="tel:70.33.205.133" value="+17033205133" target="_blank">70.33.205.133</a> 80<br>
192.168.1.131 43553 -> <a href="tel:209.84.11.254" value="+12098411254" target="_blank">209.84.11.254</a> 80<br>
192.168.1.131 43529 -> <a href="tel:209.84.11.254" value="+12098411254" target="_blank">209.84.11.254</a> 80<br>192.168.1.131 43532 -> <a href="tel:209.84.11.254" value="+12098411254" target="_blank">209.84.11.254</a> 80<br>
192.168.1.131 60342 -> <a href="tel:70.33.205.133" value="+17033205133" target="_blank">70.33.205.133</a> 80<br>192.168.1.131 42182 -> 66.235.142.3 80<br>192.168.1.131 56043 -> 138.108.6.20 80<br>
</blockquote>....<br><blockquote style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex" class="gmail_quote">192.168.1.71 16319 -> 192.168.1.131 80<br>192.168.1.71 16319 -> 192.168.1.131 80<br>
</blockquote><br><br>this is my config line:<br><blockquote style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex" class="gmail_quote"> - http-log:<br> enabled: yes<br> filename: http.log<br>
append: yes<br> #extended: yes # enable this for extended logging information<br> #filetype: regular # 'regular', 'unix_stream' or 'unix_dgram'<br> custom: yes <br><div class="im">
customformat: "%a %p -> %A %P"<br>
</div></blockquote><br>Suricata 1.4<br><br>But then again .. i am not sure what your set up exactly is (network wise).<br>Are all the log lines with http requests " out -> in " are missing ? and is it just them that are missing?<br>
<br>Thanks<span class="HOEnZb"><font color="#888888"><br clear="all"><br>-- <br><div>Regards,</div>
<div>Peter Manev</div>
</font></span></blockquote></div><br></div>