Suricata does not generate the fast.log file

Help
1

Hello Guys, I’m doing an integration of the meerkat with Mikrotik, I’m already sending the packages to the meerkat, it’s working apparently, if I do a test simulating an attack the error appears in EVEBOX, but the fast.log file is not generated, if I look at the eve.log file, everything is generating the access logs. I use a script for a virtual interface using pcap, can someone help me to generate this log file?

2

The default configuration will generate a fast.log as its enabled by default. However, only alerts will go to fast.log, while eve.json will get a lot more than just alerts.

Are you seeing event types of “alert” in eve.json, but not seeing a corresponding alert in the fast.log?

3

So, I’ll show you how I did it.
I installed SELKS.ISO, whoever comes with Suricata, ElasticSearch etc …
Okay and I created a virtual interface called eth10, and gave an ip that is not part of my network.
If I enter EVEBOX, and try to generate some HTTP failure for example, it appears there the normal ERROR, IP, TIME, etc …
But it doesn’t generate the fast.log file

I ran a github script where it uses this, tzsp2pcap
I don’t know if it influences anything.

4

I just generated an error, and looking at json, there is only the eve.json path, no fast.log

5

I’m not sure what SELKS sets up for the default configuration, but to get a fast log you’ll need something like this in your outputs section of the suricata.yaml:

# Configure the type of alert (and other) logging you would like.
outputs:
  # a line based alerts log similar to Snort's fast.log
  - fast:
      enabled: yes
      filename: fast.log
      append: yes
6

Yes, I just confirmed, this one, I’m going to do a clean installation to see if it generates the file.

fast.log and eve.log are active