<html>
<head>
<style><!--
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 12pt;
font-family:Calibri
}
--></style></head>
<body class='hmmessage'><div dir='ltr'>hi all,<div><br></div><div>i need some help because iam totaly stuck. i attach my suricata config file, my issue is that after some minutes that i run suricata, http inspection seems broken, in particulary i do some manual testing for triggering rules that dected access to .htaccess file, but suricata detect only the first 2 o 3 attempt and then nothing else even if i test from different ip and after 10 or 60 minutes the results is the same, i can see others rules firing like ip only rules and dns rules but none http rules.</div><div><br></div><div>i appreciate any type of help, advice or tuning settings, because i have done so many test.</div><div><br></div><div>thanks in advance</div><div><br></div><div>Probe HW:</div><div>8 CPU</div><div>16 gb RAM</div><div>300 HD SAS</div><div>4 nic gigabit</div><div><br></div><div>total traffic: 50 mbs suddivided to 4 NICS</div><div><br></div><div>i enabled eve logging and it shows that after some minuts dected alerts drop drastrically</div><div><br></div><div>in stats.log tcp.drop show 0 packets</div><div><br></div><div>Regards<br><br><br></div> </div></body>
</html>