<html><head></head><body><div style="color:#000; background-color:#fff; font-family:HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif;font-size:16px"><div id="yui_3_16_0_ym19_1_1479387468297_3153"><span id="yui_3_16_0_ym19_1_1479387468297_3152">Well I was really looking for complete description of all of the statistics. 2 reasons, one is a sanity check to verify that what I think I know I really do know, two is to understand the ones I don't know. My purpose here is to see if I can come up with a method to create a score that tells me the health of the instance. I have 150 sensors and I would like to focus on the least healthy sensors. To that end, having a sound understanding of the values will be really helpful.</span></div><div class="qtdSeparateBR" id="yui_3_16_0_ym19_1_1479387468297_3151"><br><br></div><div class="yahoo_quoted" id="yui_3_16_0_ym19_1_1479387468297_3074" style="display: block;"> <div style="font-family: HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif; font-size: 16px;" id="yui_3_16_0_ym19_1_1479387468297_3073"> <div style="font-family: HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif; font-size: 16px;" id="yui_3_16_0_ym19_1_1479387468297_3072"> <div dir="ltr" id="yui_3_16_0_ym19_1_1479387468297_3150"> <font size="2" face="Arial" id="yui_3_16_0_ym19_1_1479387468297_3176"> <hr size="1" id="yui_3_16_0_ym19_1_1479387468297_3272"> <b><span style="font-weight:bold;">From:</span></b> Cooper F. Nelson <cnelson@ucsd.edu><br> <b><span style="font-weight: bold;">To:</span></b> Charles DeVoe <scarecrow_57@yahoo.com>; "oisf-users@lists.openinfosecfoundation.org" <oisf-users@lists.openinfosecfoundation.org> <br> <b><span style="font-weight: bold;">Sent:</span></b> Wednesday, November 16, 2016 12:27 PM<br> <b id="yui_3_16_0_ym19_1_1479387468297_3213"><span style="font-weight: bold;" id="yui_3_16_0_ym19_1_1479387468297_3212">Subject:</span></b> Re: [Oisf-users] Description of Suricata Statistics<br> </font> </div> <div class="y_msg_container" id="yui_3_16_0_ym19_1_1479387468297_3071"><br>If you want to just dump a list of the ones you don't understand I'll do<br clear="none">my best to explain them. And I'm sure I'll be corrected if/when I make<br clear="none">mistakes!<br clear="none"><br clear="none">-Coop<br clear="none"><div class="yqt9570616807" id="yqtfd03811"><br clear="none">On 11/15/2016 9:21 AM, Charles DeVoe wrote:<br clear="none">> Next, in the Suricata stats file there are many counters/values.<br clear="none">> Some of them are intuitively obvious as to what they are (almost).<br clear="none">> Is there someplace where there is a description of what all of these<br clear="none">> values are measuring and how they are measured?</div><br clear="none"><br clear="none">-- <br clear="none">Cooper Nelson<br clear="none">Network Security Analyst<br clear="none">UCSD ITS Security Team<br clear="none"><a shape="rect" ymailto="mailto:cnelson@ucsd.edu" href="mailto:cnelson@ucsd.edu">cnelson@ucsd.edu</a> x41042<div class="yqt9570616807" id="yqtfd07747"><br clear="none"></div><br><br></div> </div> </div> </div></div></body></html>