Please include the following information with your help request:
- Suricata version
- Operating system and/or Linux distribution
- How you installed Suricata (from source, packages, something else)
Hi friends the Suricata Community,
I have recently installed Suricata on a small appliance with a xeon server (CPU E3-1245 v3) and 16gb ram running ubuntu 24.04. It is currently set up in IDS mode and it works fine.
The problem I have is that Evebox started capturing data very well, but for two days it has not shown any data, and if I click events → All, it shows events from a day ago and does not show the current events, lastly the access is slow, and if I do a status of the service I see that it is consuming a lot of RAM.
I show some logs from Suricata and Evebox:
suricata log:
{"timestamp":"2024-09-26T13:53:34.796345-0600","flow_id":1134836489579860,"in_iface":"eno2","event_type":"alert","src_ip":"45.57.103.133","src_port":443,"dest_ip":"192.168.13.224","dest_port":63942,"proto":"TCP","pkt_src":"wire/pcap","alert":{"action":"allowed","gid":1,"signature_id":2210020,"rev":2,"signature":"SURICATA STREAM ESTABLISHED packet out of window","category":"Generic Protocol Command Decode","severity":3},"app_proto":"tls","direction":"to_client","flow":{"pkts_toserver":9388,"pkts_toclient":69347,"bytes_toserver":632778,"bytes_toclient":104861047,"start":"2024-09-26T13:50:20.264224-0600","src_ip":"192.168.13.224","dest_ip":"45.57.103.133","src_port":63942,"dest_port":443}}
{"timestamp":"2024-09-26T13:53:34.796345-0600","flow_id":1134836489579860,"in_iface":"eno2","event_type":"alert","src_ip":"45.57.103.133","src_port":443,"dest_ip":"192.168.13.224","dest_port":63942,"proto":"TCP","pkt_src":"wire/pcap","alert":{"action":"allowed","gid":1,"signature_id":2210020,"rev":2,"signature":"SURICATA STREAM ESTABLISHED packet out of window","category":"Generic Protocol Command Decode","severity":3},"app_proto":"tls","direction":"to_client","flow":{"pkts_toserver":9388,"pkts_toclient":69348,"bytes_toserver":632778,"bytes_toclient":104862561,"start":"2024-09-26T13:50:20.264224-0600","src_ip":"192.168.13.224","dest_ip":"45.57.103.133","src_port":63942,"dest_port":443}}
root@sensor:~$ systemctl status evebox
● evebox.service - EveBox Server
Loaded: loaded (/usr/lib/systemd/system/evebox.service; enabled; preset: enabled)
Active: active (running) since Wed 2024-09-25 21:47:05 CST; 16h ago
Main PID: 99782 (evebox)
Tasks: 10 (limit: 18985)
Memory: 5.0G (peak: 11.2G swap: 39.2M swap peak: 39.2M)
CPU: 1h 52min 38.724s
CGroup: /system.slice/evebox.service
└─99782 /usr/bin/evebox server -c /etc/evebox/evebox.yaml
Monitoring the Evebox “Sqlite” db, the file grows quickly and I’m not sure if this could be the problem. In the Evebox configuration file I have the retention set to 7 days and no more than 20GB.
root@sensor:/var/lib/evebox$ du -h events.sqlite
39G events.sqlite
any ideas suggestions? , the software I’m using is:
- EveBox 0.18.2
- Suricata version 7.0.6
- Ubuntu 24.04
