<div dir="ltr">Epic!! This is what i was looking... Let me give it a shot. </div><div class="gmail_extra"><br><div class="gmail_quote">On Thu, Dec 3, 2015 at 4:23 AM, Javier Nieto <span dir="ltr"><<a href="mailto:jnietotn@gmail.com" target="_blank">jnietotn@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">Hi,<div><br></div><div><div>I think that setting thresholds could help you in this case scenario... <span style="line-height:1.5">Take a look at </span>/etc/suricata/threshold.config<span style="line-height:1.5"> </span></div></div><div><br></div><div><a href="https://redmine.openinfosecfoundation.org/projects/suricata/wiki/rule-thresholding" target="_blank">https://redmine.openinfosecfoundation.org/projects/suricata/wiki/rule-thresholding</a></div><div><a href="https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Global-Thresholds" target="_blank">https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Global-Thresholds</a><br></div><div><br></div><div>Regards</div><div>--</div><div>Javier Nieto</div><div><div class="h5"><br><div class="gmail_quote"><div dir="ltr">On Thu, Dec 3, 2015 at 9:35 AM Christophe Vandeplas <<a href="mailto:christophe@vandeplas.com" target="_blank">christophe@vandeplas.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">Patel,<div><br></div><div>It will probably not be a satisfying answer, as it does not prevent your disk to fill up, but I would do the following:</div><div>- configure logrotate to rotate and compress your logs when a certain filesize is reached. This will allow you to store up to 10 times the volume of logs thanks to the compression. </div><div>- configure your monitoring tool to alert you when your disk reaches 70 or 80% of usage. In combination with the logrotate you might even get multiple alerts as you will probably reach that point multiple times before logrotate kicks in and gives you extra storage again. In any case monitoring important systems are crucial, so if you're not yet monitoring it, please do. !! </div><div><br></div><div>- worst-case you can configure logrotate to remove old logfiles after X entries. However I prefer to remove them upon age to prevent loosing important info.</div><div><br></div><div>This way you keep your logs, which might be interesting for further investigation, but you also limit and controm further damage.</div><div><br></div><div>Kind regards</div></div><div dir="ltr"><div>Christophe</div><div><br></div></div><div class="gmail_extra"><br><div class="gmail_quote">On 3 December 2015 at 05:35, Satish Patel <span dir="ltr"><<a href="mailto:satish.txt@gmail.com" target="_blank">satish.txt@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">Hello,<div><br></div><div>I am running suricata-2.0.9 but suddenly yesterday we got DDoS and i found with in 10 min suricata fill 10G disk space in /var/log. many many unitifed alert files. </div><div><br></div><div>How do i optimize configuration to not fill disk and reduce logging if there is a DDoS. </div></div>
<br>_______________________________________________<br>
Suricata IDS Users mailing list: <a href="mailto:oisf-users@openinfosecfoundation.org" target="_blank">oisf-users@openinfosecfoundation.org</a><br>
Site: <a href="http://suricata-ids.org" rel="noreferrer" target="_blank">http://suricata-ids.org</a> | Support: <a href="http://suricata-ids.org/support/" rel="noreferrer" target="_blank">http://suricata-ids.org/support/</a><br>
List: <a href="https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users" rel="noreferrer" target="_blank">https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users</a><br>
Suricata User Conference November 4 & 5 in Barcelona: <a href="http://oisfevents.net" rel="noreferrer" target="_blank">http://oisfevents.net</a><br></blockquote></div><br></div>
_______________________________________________<br>
Suricata IDS Users mailing list: <a href="mailto:oisf-users@openinfosecfoundation.org" target="_blank">oisf-users@openinfosecfoundation.org</a><br>
Site: <a href="http://suricata-ids.org" rel="noreferrer" target="_blank">http://suricata-ids.org</a> | Support: <a href="http://suricata-ids.org/support/" rel="noreferrer" target="_blank">http://suricata-ids.org/support/</a><br>
List: <a href="https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users" rel="noreferrer" target="_blank">https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users</a><br>
Suricata User Conference November 4 & 5 in Barcelona: <a href="http://oisfevents.net" rel="noreferrer" target="_blank">http://oisfevents.net</a></blockquote></div></div></div></div>
</blockquote></div><br></div>