<html><body><div style="font-family: arial, helvetica, sans-serif; font-size: 12pt; color: #000000"><div>Hi There,</div><div><br data-mce-bogus="1"></div><div>I am using Suricata 4.0..3 and I am trying to convert file-store to version but it does not seem to be recognizing the change. Secondly, I am attempting to begin using the waldo file feature and it isnt being used. I have pasted that section below for reference.</div><div><br data-mce-bogus="1"></div><div>Example of my issue is that in File-store version 1 you use "log-dir" versus in version 2 you use "dir", according to the documentation, but with "version 2" in the yaml it does not recognize "dir", which is why the below example is using "log-dir".</div><div><br data-mce-bogus="1"></div><div>Any Ideas of what I am missing?</div><div><br data-mce-bogus="1"></div><div><div> - file-store:</div><div> version: 2</div><div> enabled: yes # set to yes to enable</div><div> log-dir: /var/log/suricata/files/ # directory to store the files</div><div> force-magic: yes # force logging magic on all stored files</div><div> write-fileinfo: yes</div><div> force-hash: [md5,sha256]</div><div> force-filestore: no # force storing of all files</div><div></div><div> stream-depth: 0</div><div> waldo: file.waldo # waldo file to store the file_id across runs</div><div></div><div><br data-mce-bogus="1"></div><div>Exert from start up log:</div><div><br data-mce-bogus="1"></div><div><div>27/2/2018 -- 15:10:19 - <Info> - 1 rule files processed. 1 rules successfully loaded, 0 rules failed</div><div>27/2/2018 -- 15:10:19 - <Info> - Threshold config parsed: 0 rule(s) found</div><div>27/2/2018 -- 15:10:19 - <Info> - 1 signatures processed. 0 are IP-only rules, 0 are inspecting packet payload, 1 inspect application layer, 0 are decoder event only</div><div>27/2/2018 -- 15:10:19 - <Info> - dropped the caps for main thread</div><div>27/2/2018 -- 15:10:19 - <Info> - fast output device (regular) initialized: fast.log</div><div>27/2/2018 -- 15:10:19 - <Info> - eve-log output device (regular) initialized: /var/log/suricata/flows/current/dns.json</div><div>27/2/2018 -- 15:10:19 - <Info> - eve-log output device (regular) initialized: /var/log/suricata/flows/current/tls.json</div><div>27/2/2018 -- 15:10:19 - <Info> - eve-log output device (regular) initialized: /var/log/suricata/flows/current/files.json</div><div>27/2/2018 -- 15:10:19 - <Info> - eve-log output device (regular) initialized: /var/log/suricata/flows/current/http.json</div><div>27/2/2018 -- 15:10:19 - <Info> - eve-log output device (regular) initialized: /var/log/suricata/flows/current/ssh.json</div><div>27/2/2018 -- 15:10:19 - <Info> - eve-log output device (regular) initialized: /var/log/suricata/flows/current/smtp.json</div><div>27/2/2018 -- 15:10:19 - <Info> - eve-log output device (regular) initialized: /var/log/suricata/flows/current/flow.json</div><div>27/2/2018 -- 15:10:19 - <Info> - Using log dir /var/tmp/openfpyc/pcap/</div><div>27/2/2018 -- 15:10:19 - <Info> - using normal logging</div><div>27/2/2018 -- 15:10:19 - <Info> - stats-json output device (regular) initialized: /var/log/suricata/stats/stats-meta.log</div><div>27/2/2018 -- 15:10:19 - <Info> - Syslog output initialized</div><div>27/2/2018 -- 15:10:19 - <Info> - forcing magic lookup for stored files</div><div>27/2/2018 -- 15:10:19 - <Info> - storing files in /var/log/suricata/files/</div><div>27/2/2018 -- 15:10:19 - <Info> - file-log output device (regular) initialized: files-json.log</div><div>27/2/2018 -- 15:10:19 - <Info> - forcing magic lookup for logged files</div><div>27/2/2018 -- 15:10:19 - <Info> - Going to use 8 thread(s)</div><div>27/2/2018 -- 15:10:19 - <Info> - Initializing PCAP ring buffer for /var/tmp/openfpyc/pcap//openfpyc.pcap.</div><div>27/2/2018 -- 15:10:19 - <Notice> - Ring buffer initialized with 415 files.</div><div>27/2/2018 -- 15:10:19 - <Info> - Going to use 8 thread(s)</div><div>27/2/2018 -- 15:10:19 - <Info> - Going to use 8 thread(s)</div><div>27/2/2018 -- 15:10:19 - <Notice> - all 24 packet processing threads, 4 management threads initialized, engine started.</div></div><div><br></div><div><br></div></div><div><br></div><div data-marker="__SIG_PRE__"><div><span style="font-family: 'Segoe UI', 'Lucida Sans', sans-serif; font-size: 14.16px;" data-mce-style="font-family: 'Segoe UI', 'Lucida Sans', sans-serif; font-size: 14.16px;">Jeremy Grove, SSCP</span><br style="font-family: 'Segoe UI', 'Lucida Sans', sans-serif; font-size: 14.16px;" data-mce-style="font-family: 'Segoe UI', 'Lucida Sans', sans-serif; font-size: 14.16px;"><span style="font-family: 'Segoe UI', 'Lucida Sans', sans-serif; font-size: 14.16px;" data-mce-style="font-family: 'Segoe UI', 'Lucida Sans', sans-serif; font-size: 14.16px;">Senior Information Security Analyst</span><br style="font-family: 'Segoe UI', 'Lucida Sans', sans-serif; font-size: 14.16px;" data-mce-style="font-family: 'Segoe UI', 'Lucida Sans', sans-serif; font-size: 14.16px;"><span style="font-family: 'Segoe UI', 'Lucida Sans', sans-serif; font-size: 14.16px;" data-mce-style="font-family: 'Segoe UI', 'Lucida Sans', sans-serif; font-size: 14.16px;">Quadrant Information Security</span><br style="font-family: 'Segoe UI', 'Lucida Sans', sans-serif; font-size: 14.16px;" data-mce-style="font-family: 'Segoe UI', 'Lucida Sans', sans-serif; font-size: 14.16px;"><br><br><br></div></div></div></body></html>