Actions
Bug #1048
closedPF_RING/DNA config - suricata.yaml
Affected Versions:
Effort:
Difficulty:
Label:
Description
With DNA installed and configured, in the pfring section of the Suricata we should have :
... - interface: dna0@1 threads: 1 - interface: dna0@2 threads: 1 ....
However when we load , we have:
[16115] 28/11/2013 -- 12:26:44 - (runmode-pfring.c:278) <Error> (ParsePfringConfig) -- [ERRCODE: SC_ERR_INVALID_ARGUMENT(13)] - Could not get cluster-id from config [16115] 28/11/2013 -- 12:26:44 - (runmode-pfring.c:310) <Error> (ParsePfringConfig) -- [ERRCODE: SC_ERR_GET_CLUSTER_TYPE_FAILED(35)] - Could not get cluster-type fron config [16115] 28/11/2013 -- 12:26:44 - (util-runmodes.c:545) <Info> (RunModeSetLiveCaptureWorkersForDevice) -- Going to use 1 thread(s) [16117] 28/11/2013 -- 12:26:44 - (source-pfring.c:425) <Info> (ReceivePfringThreadInit) -- DNA interface detected, not adding thread to cluster [16117] 28/11/2013 -- 12:26:44 - (source-pfring.c:449) <Info> (ReceivePfringThreadInit) -- (RxPFRdna0@01) Using PF_RING v.5.6.2, interface dna0@0, cluster-id 1, single-pfring-thread [16115] 28/11/2013 -- 12:26:44 - (runmode-pfring.c:278) <Error> (ParsePfringConfig) -- [ERRCODE: SC_ERR_INVALID_ARGUMENT(13)] - Could not get cluster-id from config [16115] 28/11/2013 -- 12:26:44 - (runmode-pfring.c:310) <Error> (ParsePfringConfig) -- [ERRCODE: SC_ERR_GET_CLUSTER_TYPE_FAILED(35)] - Could not get cluster-type fron config [16115] 28/11/2013 -- 12:26:44 - (util-runmodes.c:545) <Info> (RunModeSetLiveCaptureWorkersForDevice) -- Going to use 1 thread(s)
Everything still works and Suricata starts and loads and is running
fine - it is just the ERR msgs.
If we use:
- interface: dna0@1 threads: 1 cluster-id: 1 cluster-type: cluster_flow - interface: dna0@2 threads: 1 cluster-id: 2 cluster-type: cluster_flow .....
Suricata loads and works fine and there are no ERR or warning msgs.
However we do not need to give cluster id and type since in DNA
there is no SW balancing.
P.S.
There is a spelling mistake in the ERR msg:
Could not get cluster-type fron
fron, should be from.
Thanks
Actions