- eve-log:
enabled: yes
filetype: regular
filename: eve-%Y-%m-%d-%H:%M.json
types:
- alert:
tagged-packets: yes
app-layer: true
flow: true
rule: true
metadata: true
raw: false
- drop:
alerts: yes
flows: all
Use the essentials in router + Suricata.Does this look normal for Suricata as far as processes, memory and cpu usage?
Use the essentials in router + Suricata.
It's working well here.
I formatted the generation of eve.log.
There will only be alerts and drops. This avoids wasting resources.
Code:- eve-log: enabled: yes filetype: regular filename: eve-%Y-%m-%d-%H:%M.json types: - alert: tagged-packets: yes app-layer: true flow: true rule: true metadata: true raw: false - drop: alerts: yes flows: all
get new suricata.yaml. After, stop and start SuricataAlso, do I need to keep the dns.log enabled? It is currently at 8m and growing.
It is not normal. I checked here. With one process. It's normal. Try rebooting.I was just wondering if multiple processes was normal for Suricata ?
get new suricata.yaml. After, stop and start Suricata
https://suricata.readthedocs.io/en/suricata-4.1.3/configuration/suricata-yaml.htmlDo I need to make any changes in this section?
is in non multi thread modethreading:
set-cpu-affinity: no
For now, it seems to be incompatible. You need to know the firmware environment well. Maybe someone here on the forum with FW Merlin knowledge and using Suricata will help. It's waiting.due to the nature of these features, and we must chose to use one or the other?
I formatted the generation of eve.log.
There will only be alerts and drops. This avoids wasting resources.
Code:- eve-log: enabled: yes filetype: regular filename: eve-%Y-%m-%d-%H:%M.json types: - alert: tagged-packets: yes app-layer: true flow: true rule: true metadata: true raw: false - drop: alerts: yes flows: all
W
Will advise if I see hits. Getting used to Suricata!
Welcome To SNBForums
SNBForums is a community for anyone who wants to learn about or discuss the latest in wireless routers, network storage and the ins and outs of building and maintaining a small network.
If you'd like to post a question, simply register and have at it!
While you're at it, please check out SmallNetBuilder for product reviews and our famous Router Charts, Ranker and plenty more!