<html><body><div style="font-family: arial, helvetica, sans-serif; font-size: 12pt; color: #000000"><div>Hello All,</div><div><br data-mce-bogus="1"></div><div>We use Suricata in a variety of situations with varying amounts of data input. The version that is currently being used is Suricata version 4.1.0-beta1 and we have upgraded a portion to Suricata version 4.1.0. In both versions I am running into an issue with the meta data where it will stop logging entirely or it will only log some of the protocols. This is while Suricata is still running. </div><div><br data-mce-bogus="1"></div><div>An idea of the configuration:</div><div><br data-mce-bogus="1"></div><div><div> - eve-log:</div><div> enabled: yes</div><div> filetype: regular #regular|syslog|unix_dgram|unix_stream|redis</div><div> filename: /var/log/suricata/flows/current/dns.json</div><div> pcap-file: false</div><div> types:</div><div> - dns:</div><div> version: 2 </div><div> - eve-log:</div><div> enabled: yes</div><div> filetype: regular #regular|syslog|unix_dgram|unix_stream|redis</div><div> filename: /var/log/suricata/flows/current/tls.json</div><div> pcap-file: false</div><div> types:</div><div> - tls:</div><div> extended: yes # enable this for extended logging information</div><div> - eve-log:</div><div> enabled: yes</div><div> filetype: regular #regular|syslog|unix_dgram|unix_stream|redis</div><div> filename: /var/log/suricata/flows/current/files.json</div><div> pcap-file: false</div><div> types:</div><div> - files:</div><div> force-magic: no # force logging magic on all logged files</div><div> force-hash: [md5] # force logging of md5 checksums</div><div> - eve-log:</div><div> enabled: yes</div><div> filetype: regular #regular|syslog|unix_dgram|unix_stream|redis</div><div> filename: /var/log/suricata/flows/current/http.json</div><div> pcap-file: false</div><div> types: </div><div> - http:</div><div> extended: yes # enable this for extended logging information</div><div> # custom allows additional http fields to be included in eve-log</div><div> # the example below adds three additional fields when uncommented</div><div> custom: [accept, accept-charset, accept-encoding, accept-language,</div><div> accept-datetime, authorization, cache-control, cookie, from,</div><div> max-forwards, origin, pragma, proxy-authorization, range, te, via,</div><div> x-requested-with, dnt, x-forwarded-proto, accept-range, age,</div><div> allow, connection, content-encoding, content-language,</div><div> content-length, content-location, content-md5, content-range,</div><div> content-type, date, etags, last-modified, link, location,</div><div> proxy-authenticate, referrer, refresh, retry-after, server,</div><div> set-cookie, trailer, transfer-encoding, upgrade, vary, warning,</div><div> www-authenticate, x-flash-version, x-authenticated-user]</div><div> - eve-log:</div><div> enabled: yes</div><div> filetype: regular #regular|syslog|unix_dgram|unix_stream|redis</div><div> filename: /var/log/suricata/flows/current/ssh.json</div><div> pcap-file: false</div><div> types:</div><div> - ssh</div><div> - eve-log:</div><div> enabled: yes</div><div> filetype: regular #regular|syslog|unix_dgram|unix_stream|redis</div><div> filename: /var/log/suricata/flows/current/smtp.json</div><div> pcap-file: false</div><div> types:</div><div> - smtp:</div><div> extended: yes # enable this for extended logging information</div><div> custom: [received, x-mailer, x-originating-ip, relays, reply-to, bcc]</div><div> - eve-log:</div><div> enabled: yes</div><div> filetype: regular #regular|syslog|unix_dgram|unix_stream|redis</div><div> filename: /var/log/suricata/flows/current/flow.json</div><div> pcap-file: false</div><div> types:</div><div> - flow</div><div> - eve-log:</div><div> enabled: yes</div><div> filetype: regular #regular|syslog|unix_dgram|unix_stream|redis</div><div> filename: /var/log/suricata/flows/current/nfs.json</div><div> pcap-file: false</div><div> types:</div><div> - nfs</div><div> - eve-log:</div><div> enabled: yes</div><div> filetype: regular #regular|syslog|unix_dgram|unix_stream|redis</div><div> filename: /var/log/suricata/flows/current/smb.json</div><div> pcap-file: false</div><div> types:</div><div> - smb</div><div> - eve-log:</div><div> enabled: yes</div><div> filetype: regular #regular|syslog|unix_dgram|unix_stream|redis</div><div> filename: /var/log/suricata/flows/current/tftp.json</div><div> pcap-file: false</div><div> types:</div><div> - tftp</div><div> - eve-log:</div><div> enabled: yes</div><div> filetype: regular #regular|syslog|unix_dgram|unix_stream|redis</div><div> filename: /var/log/suricata/flows/current/ikev2.json</div><div> pcap-file: false</div><div> types:</div><div> - ikev2</div><div> - eve-log:</div><div> enabled: yes</div><div> filetype: regular #regular|syslog|unix_dgram|unix_stream|redis</div><div> filename: /var/log/suricata/flows/current/dhcp.json</div><div> pcap-file: false</div><div> types:</div><div> - dhcp</div></div><div><br></div><div>I am happy to provide more detail to anyone willing to give an opinion on how this may be addressed but I am not sure exactly what is useful to know. </div><div><br data-mce-bogus="1"></div><div>Has anyone else seen this behavior? This is a critical piece for us and I will need to switch back to Bro/Zeek until I can get this resolved.</div><div><br data-mce-bogus="1"></div><div>Regards,</div><div><br></div><div data-marker="__SIG_PRE__"><div><span style="font-family: 'Segoe UI', 'Lucida Sans', sans-serif; font-size: 14.16px;">Jeremy Grove, SSCP</span><br style="font-family: 'Segoe UI', 'Lucida Sans', sans-serif; font-size: 14.16px;"><span style="font-family: 'Segoe UI', 'Lucida Sans', sans-serif; font-size: 14.16px;">Security Engineer</span><br style="font-family: 'Segoe UI', 'Lucida Sans', sans-serif; font-size: 14.16px;"><span style="font-family: 'Segoe UI', 'Lucida Sans', sans-serif; font-size: 14.16px;">Quadrant Information Security</span><br style="font-family: 'Segoe UI', 'Lucida Sans', sans-serif; font-size: 14.16px;"><br style="font-family: 'Segoe UI', 'Lucida Sans', sans-serif; font-size: 14.16px;"><br style="font-family: 'Segoe UI', 'Lucida Sans', sans-serif; font-size: 14.16px;"><span style="font-family: 'Segoe UI', 'Lucida Sans', sans-serif; font-size: 14.16px;">Learn more= about our managed SIEM <span class="Object" id="OBJ_PREFIX_DWT149_com_zimbra_url" style="color: #005a95; cursor: pointer;"><a href="https://a.quadrantsec.com/3D%22https://quadrantsec.com/SaganMSSP%22" target="_blank" style="color: #005a95; text-decoration: none; cursor: pointer;">people + product</a></span></span><br><br><br></div></div></div></body></html>