I use the latest version,
But my two files(fast.log,alert-debug.log) are inconsistent
For example, rules related to the dns protocol cannot be triggered in two log files at the same time
How does your config look like and how do you run Suricata?
Thank you for your answer
this is my config (suricata.yamlsuricata.yaml (70.5 KB)
)
This is my start command
suricata -c /etc/suricata/suricata.yaml -i eno2 -F /etc/suricata/cap-filter.bpf
cap-filter.bpf (86 Bytes)
We think this is a very good product, it may be a problem with my use, I hope you can guide us
Do you see more in the fast.log compared to alert-debug.log? Can you also try to see how it looks like with the EVE json log?
Do you have some examples?