Actions
Bug #1496
closedconfusing logging error message
Status:
Closed
Priority:
Normal
Assignee:
-
Target version:
-
Affected Versions:
Effort:
Difficulty:
Label:
Description
When starting Suricata in lxc on one of my servers I got the following error:
<Error> - [ERRCODE: SC_ERR_MISSING_CONFIG_PARAM(118)] - NO logging compatible with daemon mode selected, suricata won't be able to log. Please update 'logging.outputs' in the YAML.
<Notice> - This is Suricata version 2.1beta4 RELEASE
It's is especially confusing because on another server the same configuration works just fine.
/etc/default/suricata:
RUN=yes
RUN_AS_USER=
SURCONF=/etc/suricata/suricata.yaml
LISTENMODE=af-packet
IFACE=eth0
NFQUEUE=0
TCMALLOC="YES"
PIDFILE=/run/suricata.pid
/etc/suricata/suricata.yaml:
outputs:
- a line based alerts log similar to Snort's fast.log
- fast:
enabled: yes
filename: fast.log
append: yes
#filetype: regular # 'regular', 'unix_stream' or 'unix_dgram'
- Extensible Event Format (nicknamed EVE) event log in JSON format
- eve-log:
enabled: yes
Where can I read more about logging compatibility with daemon mode (and why it's related in a first place?)
Actions