Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Suricata alerts not showing up in telegraf config #2369

Closed
tiny-pangolin opened this issue May 1, 2021 · 1 comment
Closed

Suricata alerts not showing up in telegraf config #2369

tiny-pangolin opened this issue May 1, 2021 · 1 comment

Comments

@tiny-pangolin
Copy link
Contributor

Important notices
Before you add a new report, we ask you kindly to acknowledge the following:

[-] I have read the contributing guide lines at https://github.com/opnsense/plugins/blob/master/CONTRIBUTING.md

[-] I have searched the existing issues and I'm convinced that mine is new.

[-] The title contains the plugin to which this issue belongs

Describe the bug
Intrusion Detection Alerts input not showing in /usr/local/etc/telegraf.conf

To Reproduce
Steps to reproduce the behavior:

  1. Go to Services > Telegraf > Input
  2. Check Intrusion Detection Alerts and save
  3. Restart to Telegraf
  4. ssh into firewall
  5. cat /usr/local/etc/telegraf.conf

Expected behavior
Checking the box places the following into /usr/local/etc/telegraf.conf

[[inputs.tail]]
  data_format = "json"
  files = ["/var/log/suricata/eve.json"]
  name_override = "suricata"
  tag_keys = ["event_type","src_ip","src_port","dest_ip","dest_port"]
  json_string_fields = ["*"]

Environment
OPNsense 21.1.5 (amd64, LibreSSL).
Proxmox VM and libvirt virtual machines
Network Intel

@psychogun
Copy link
Contributor

Are you able to get any metrics using this configuration?

According to https://github.com/influxdata/telegraf/tree/master/plugins/inputs/tail

Metrics are produced according to the data_format option. Additionally a tag labeled path is added to the metric containing the filename being tailed.

Nothing is showing here in my InfluxDBv2 installation, even though eve.json contains data :o

  • OPNsense 21.1.8_1-amd64
  • InfluxDB 2.0.7
  • Telegraf 1.19.0

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Development

No branches or pull requests

2 participants