Better logging for cron; rule revision matching - v1 #350
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
The current default is to use SC_LOG_LEVEL=warning which can output
non-fatal warnings which is generally not what you want when running
from cron with "suricata-update -q".
Now, if "-q" is provided, run Suricata with SC_LOG_LEVEL=error which
is useful for cron to ony be notified of fata errors. Generally
end-users are not worried about rule warnings such as:
ja3.hash should not be used together with nocase, since the rule
is automatically lowercased anyway which makes nocase redundant.
This also allows for log level be set with SC_LOG_LEVEL, in which case
Suricata-Update will not change the log level.
Additionally, make Suricata more verbose if Suricata-Update is run
with "-v".
Ticket: https://redmine.openinfosecfoundation.org/issues/7494
A rule ID can now be matched with a revision given the following format of: <gid>:<sid>:<rev> The <gid> has to be specified for a revision match, as a specifier with 2 components is read as "gid" and "rev". Ticket: https://redmine.openinfosecfoundation.org/issues/7425
|
Back to draft, still have this with -q: |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Tickets:
Notes:
1:223330:3. The GID is required in this case.