Fast.log not being written to

Help
1

Version: Suricata 7.0.6
OS: AlmaLinux 8.9
Installation: rpm install

No alerts are being written to fast.log despite it being enabled. I followed the quickstart alerting but nothing gets logged. Appreciate any help/suggestions.

2

What about the /var/log/suricata/eve.json file? Could be that no alert triggering traffic is occurring, but you could still be getting metadata (other event type).

3

eve.json logs the event. I can attach the relevant entries in eve.json if that helps; have to sanitize it first.

4

If you’re getting alert event types in eve.json, there should also be entries in fast.log

Can you post the output from suricata -c /path/to/your/suricata.yaml --dump-config|grep fast

This is what displays on my system when doing that:

outputs.0 = fast
outputs.0.fast = (null)
outputs.0.fast.enabled = yes
outputs.0.fast.filename = fast.log
outputs.0.fast.append = yes
engine-analysis.rules-fast-pattern = yes
5

Output as follows:

outputs.0 = fast
outputs.0.fast = (null)
outputs.0.fast.enabled = yes
outputs.0.fast.filename = fast.log
outputs.0.fast.append = yes
outputs.0.fast.filetype = regular
engine-analysis.rules-fast-pattern = yes

6

The fast.log and eve.json should be in the same logging directory.

The default logging directory is in the suricata configuration file – look for default-log-dir
This value can be overridden from the command line if -l /path/to/log-dir is added

I suspect a permissions issue … are you launching suricata as root ? Are you using the run-as configuration setting?
Can you post the output of ls -ld /path/to/log-dir?

7

Running as root.

default-log-dir: /var/log/suricata/

ls -ld /var/log/suricata
drwxr-x—. 2 root root 4096 Sep 3 06:00 /var/log/suricata
[root@pat-test-01 suricata]$

8

Does curling http://testmynids.org/uid/index.html versus https://testmynids.org/uid/index.html
make a difference in this test?

9

Are you using this rule (mentioned in the quickstart quite)? If so, yes, the content should be available for inspection (and hence, not encrypted):

alert ip any any -> any any (msg:"GPL ATTACK_RESPONSE id check returned root"; content:"uid=0|28|root|29|"; classtype:bad-unknown; sid:2100498; rev:7; metadata:created_at 2010_09_23, updated_at 2010_09_23;)
10

Could you post your suricata.yaml config file (or, dm the file)?

11

verified the rule is the same.

12

I dm the file to you.

13

Upon further inspection of the eve.json log, on a system that takes a lot more traffic, it looks like alerts are not generated.

14

I may have this resolved, in a holding pattern for now, will update when I know more.