Missing event data from Eve log

Help
1

Hi

Can anyone tell me why I’m getting different data in two eve logs I have setup?

I have the following log outputs configured:

  • eve-log:
    enabled: yes
    filetype: unix_dgram #regular|syslog|unix_dgram|unix_stream|redis
    filename: /var/log/suricata/event.socket
    types:
    - alert

  • eve-log:
    enabled: yes
    filetype: regular #regular|syslog|unix_dgram|unix_stream|redis
    filename: eve-%Y-%m-%d.json
    rotate-interval: 7d

I also have logging of payload enabled as follows:

types:
- alert:
payload: yes # enable dumping payload in Base64

The payload data appears in the .json log as intended but when I monitor data sent to the socket I don’t see the payload here.

Why would this be?

Thanks?

2

This seems to work fine for me using 5.0.3 (and git master). Two thoughts come to mind:

  • The indentation of your yaml might be off, please double check.
  • Could the be getting truncated? Are you able to try unix_stream?
3

Indentation was off - Thanks

4

Apologies I was mistaken, the same behaviour remains.

This is actually the preferred behaviour as I have no need to send payload data to the socket. I just can’t understand how I’ve managed to accomplish it :thinking:

Is it actually possible to configure this behaviour or does the addition of the payload configuration apply globally to all configured eve outputs?

Thanks,

5

Yes. With this config I have the payload being logged to a file, but not logged to the socket:

outputs:
  - eve-log:
      enabled: yes
      filetype: regular
      filename: eve.json
      types:
        - alert:
            payload: yes
  - eve-log:
      enabled: yes
      filetype: unix_dgram
      filename: /tmp/eve.json
      types:
        - alert:
6

Tested and working.

Thanks