Hi,
I’m testing SELKS 10 which includes a dockerised version of Suricata (8.0.0-dev).
I managed to enable fast.log. The file has been immediately created in the log directory.
The problem: I trigger alerts that can be seen in eve.json but nothing is writted in fast.log. Permissions and owner of fast.log are the same than eve.json (owner & group id 994, can write). On the other hand, I can see eve.json to be updated almost in real time.
In fact, the fast.log file is updated only when I reboot the machine where resides SELKS.
Is this the expected behavior or a bug? May I overlooked a setting somewhere?