Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Allow user to log detailed rule report #301

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

inashivb
Copy link
Member

@inashivb inashivb commented Mar 24, 2022

Add a --report <filename> option so that the end user is able to log a
report about the rules enabled, disabled, modified and dropped.
Usage

$ suricata-update --report /tmp/rules.log

Sample Report

Suricata-Update Summary - Thursday, 24 Mar 2022, 13:20:30

Summary
=======
Rules disabled by disable.conf: 148
Rules enabled by enable.conf: 0
Rules modified by modify.conf: 0
Rules converted to drop: 0
Rules enabled for flowbit dependencies: 131
Rules added: 274
Rules removed: 17
Rules modified: 1721

Added Rules
-----------
[1:2500036] ET COMPROMISED Known Compromised or Hostile Host Traffic group 19 (compromised.rules)
[1:2500038] ET COMPROMISED Known Compromised or Hostile Host Traffic group 20 (compromised.rules)

Link to redmine ticket: https://redmine.openinfosecfoundation.org/issues/2256

Previous PR: #300

Changes since v9:

  • Updated changed variable name all through the function

Add a `--report <filename>` option so that the end user is able to log a
report about the rules enabled, disabled, modified and dropped.
Usage
```
$ ./bin/suricata-update --report /tmp/rules.log
```

Sample Report

```
Suricata-Update Summary - Thursday, 24 Mar 2022, 13:20:30

Summary
=======
Rules disabled by disable.conf: 148
Rules enabled by enable.conf: 0
Rules modified by modify.conf: 0
Rules converted to drop: 0
Rules enabled for flowbit dependencies: 131
Rules added: 274
Rules removed: 17
Rules modified: 1721

Added Rules
-----------
[1:2500036] ET COMPROMISED Known Compromised or Hostile Host Traffic group 19 (compromised.rules)
[1:2500038] ET COMPROMISED Known Compromised or Hostile Host Traffic group 20 (compromised.rules)

```

Ticket: 2256
@inashivb inashivb requested a review from jasonish as a code owner March 24, 2022 10:21
@gordnhoo
Copy link

Hello don't know if this already exists but why not also adding to the logging if the update happened successfully or not ?I think this would be a nice addition

@jasonish
Copy link
Member

Success is reported by the exit status, so there are a few way to achieve this. If using cron, cron will typically log the failure and output. If already processing your system logs, it should be searchable.

If not using cron, but some other tool to schedule the update, that should then check the exit status and report error/success.

Alternatively, the output could be redirected to a file, then the log checked for "Warning" or "Error" messages.

Ultimately the best solution probably depends on how you wish to be notified of errors. But I believe Suricata-Update provides enough for the reporting of the errors already.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Development

Successfully merging this pull request may close these issues.

3 participants