<div dir="ltr">Does your build environment contain libjansson?  Without libjansson you won't get JSON output support.  See libjansson: below.<br><br>Suricata Configuration:<br>  AF_PACKET support:                       yes<br>
  PF_RING support:                         no<br>  NFQueue support:                         no<br>  IPFW support:                            no<br>  DAG enabled:                             no<br>  Napatech enabled:                        no<br>
  Unix socket enabled:                     yes<br><br>  libnss support:                          yes<br>  libnspr support:                         yes<br>  libjansson support:                      yes<br>  Prelude support:                         no<br>
  PCRE jit:                                yes<br>  libluajit:                               no<br>  libgeoip:                                no<br>  Non-bundled htp:                         no<br>  Old barnyard2 support:                   no<br>
  CUDA enabled:                            no<br><br>  Suricatasc install:                      yes<br><br>  Unit tests enabled:                      no<br>  Debug output enabled:                    no<br>  Debug validation enabled:                no<br>
  Profiling enabled:                       no<br>  Profiling locks enabled:                 no<br><br></div><div class="gmail_extra"><br><br><div class="gmail_quote">On Mon, Feb 10, 2014 at 4:50 PM, Peter Manev <span dir="ltr"><<a href="mailto:petermanev@gmail.com" target="_blank">petermanev@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div class="">On Mon, Feb 10, 2014 at 5:37 PM, Stefan Sabolowitsch<br>
<<a href="mailto:Stefan.Sabolowitsch@felten-group.com">Stefan.Sabolowitsch@felten-group.com</a>> wrote:<br>
> Hi all,<br>
> have here 2.0dev (rev 18edec8) and want to test the new "eve-log" json output file format, however i get this Warning.<br>
><br>
> [29739] 10/2/2014 -- 16:18:55 - (runmodes.c:580) <Warning> (RunModeInitializeOutputs) -- [ERRCODE: SC_ERR_INVALID_ARGUMENT(13)] No output module named eve-log, ignoring<br>
><br>
> thanks for any help.<br>
> Stefan<br>
<br>
<br>
<br>
</div>What does your yaml section for eve-log look like?<br>
<span class="HOEnZb"><font color="#888888"><br>
<br>
--<br>
Regards,<br>
Peter Manev<br>
</font></span><div class="HOEnZb"><div class="h5">_______________________________________________<br>
Suricata IDS Users mailing list: <a href="mailto:oisf-users@openinfosecfoundation.org">oisf-users@openinfosecfoundation.org</a><br>
Site: <a href="http://suricata-ids.org" target="_blank">http://suricata-ids.org</a> | Support: <a href="http://suricata-ids.org/support/" target="_blank">http://suricata-ids.org/support/</a><br>
List: <a href="https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users" target="_blank">https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users</a><br>
OISF: <a href="http://www.openinfosecfoundation.org/" target="_blank">http://www.openinfosecfoundation.org/</a><br>
</div></div></blockquote></div><br></div>