[Discussion] Suricata 2.0.1 logging

[Victor Julien]

Please keep the conversation on the list.

On 05/26/2014 02:54 PM, Lance Lassetter wrote:
> It is attached, thanks.

It's clear that Suricata is not seeing any traffic. If you use the
normal (non-REPEAT mode), does it work then?

> On May 26, 2014 3:45 AM, Victor Julien <lists at inliniac.net> wrote:
>>
>> On 05/24/2014 05:12 PM, Lance Lassetter wrote: 
>>> Fedora just upgraded their stable repos to Suricata 2.0.1 and now nothing is logged with the version 2 and IPS mode.  All logfiles are created and I "iptables -vL" the NFQUEUE is seeing packets in Suricata IPS repeat mode.  Everything looks correct and I parsed and updated the new suricata.yaml.rpmnew and renamed it to suricata.yaml then restarted Suricata.  I even deleted the old logfiles and let suricata create the new ones in either /var/log/suricata or /var/log/IPS. 
>>>
>>> Once again the logfiles are created by starting Suricata and waiting a minute but they are all blank except for stats.log. 
>>
>> Can you share a record of your stats.log? 

-- 
---------------------------------------------
Victor Julien
http://www.inliniac.net/
PGP: http://www.inliniac.net/victorjulien.asc
---------------------------------------------