Hi there. My suricata is giving me alerts but the eve.json only shows “event_type”:“flow”. I have everything enabled. Also, i don´t receive any information of http.log and tls.log. Also ssh is not receiving any logs.
Can you help me please?
How did you determine there are alerts? In fast.log?
Yes, fast.log is being populated.
So check the settings in suricata.yaml well.
I checked over and over. That´s why i need help
Can you paste the eve-log section from your yaml?
SURICATA.zip (3.8 KB)
I was able to put it to work by disabling vlan-use-for-tracking. Yet, stil getting no info for ssh and snmp
How does your setup exactly look like?