Bug #2465: Eve Stats will not be reported unless stats.log is enabled - Suricata - Open Information Security Foundation

Actions

Copy link

Bug #2465

closed

Eve Stats will not be reported unless stats.log is enabled

Added by Danny Browning over 6 years ago. Updated about 5 years ago.

Status:

Closed

Priority:

Normal

Assignee:

Victor Julien

Target version:

5.0.0

Affected Versions:

Effort:

Difficulty:

Label:

Description

If stats section enabled is set to no, adding stats type to eve alert configuration will not cause stats to be emitted over json. Stats type must be added to eve configuration AND stats log must be enabled.

Actions

Copy link

Updated by Danny Browning over 6 years ago

This might just be a documentation thing that using stats type for eve requires enabled. It looks like if filename is not set, no file is written is disk.

Actions

Copy link

Updated by Andreas Herz over 6 years ago

Assignee set to OISF Dev
Target version set to TBD

Actions

Copy link

Updated by Andreas Herz over 5 years ago

I guess we still want to have the option to disable stats.log and just use the stats within EVE?!

Actions

Copy link

Updated by Danny Browning over 5 years ago

Yeah, it's more of a documentation thing, since you can't just use the stats in eve by adding `- stats`, you also have to have stats enabled. If you don't want stats on disk, you have to make sure no stats filename is specified.

Actions

Copy link

Updated by Andreas Herz over 5 years ago

I think it's still confusing and documentation only helps a bit. Any thoughts on that from Victor?

Actions

Copy link

Updated by Victor Julien about 5 years ago

I guess we could see if enabling stats in eve or as a separate log could automatically enable the global setting. It is a global thing because it is still usable over unix socket even if all outputs are disabled.

Actions

Copy link