Re: Unified2 Missing event record
Ron H via Snort-devel <[email protected]> Tue, 16 Jul 2019 19:50:03 +0300
| Newsgroups | gmane.comp.security.ids.snort.devel |
|---|---|
| Message-ID | <CAKhaoyehsFj6Npb6wX8jvfWbkjxL06W9oyh6=TnX9b=j1zoVKw@mail.gmail.com> |
--===============8939363774613093146== Content-Type: multipart/alternative; boundary="00000000000063f332058dcf2c32" --00000000000063f332058dcf2c32 Content-Type: text/plain; charset="UTF-8" More details: Our application creates pcaps files from unified2 snort output. The application read unified2 records (Event record and Packet record) The issue is Snort writes unifed2 files frequently without event record (Only Packet record) This situation can be normal? Thanks, Ron :) On Tue, Jul 16, 2019 at 7:42 PM Ron H <[email protected]> wrote: > UP! :) > Does someone know this issue? > > On Mon, Jul 8, 2019 at 7:31 PM Ron H <[email protected]> wrote: > >> Hey Snort devel, >> >> We have an issue with Snort Unified2 output. >> Snort write packet record without write event record. >> This issue happens frequently. >> >> out snort version is *2.9.11.1* >> Snort run on Ubuntu 16.04 Docker container >> >> We are would be grateful to any assistance. >> Thanks! >> >> >> >> >> >> >> --00000000000063f332058dcf2c32 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable <div dir=3D"ltr">More details:<div>Our application creates pcaps files from= unified2 snort output.</div><div>The application read unified2 records (Ev= ent record and Packet record)</div><div>The issue is Snort writes unifed2 f= iles frequently without event record (Only Packet record)</div><div><br></d= iv><div>This situation can be normal?=C2=A0</div><div><br></div><div>Thanks= ,</div><div>Ron :)</div><div>=C2=A0</div></div><br><div class=3D"gmail_quot= e"><div dir=3D"ltr" class=3D"gmail_attr">On Tue, Jul 16, 2019 at 7:42 PM Ro= n H <<a href=3D"mailto:[email protected]">[email protected]</a>> = wrote:<br></div><blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0= px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir= =3D"ltr">UP! :)=C2=A0<div>Does someone know this issue?=C2=A0</div></div><b= r><div class=3D"gmail_quote"><div dir=3D"ltr" class=3D"gmail_attr">On Mon, = Jul 8, 2019 at 7:31 PM Ron H <<a href=3D"mailto:[email protected]" tar= get=3D"_blank">[email protected]</a>> wrote:<br></div><blockquote clas= s=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid r= gb(204,204,204);padding-left:1ex"><div dir=3D"ltr">Hey Snort devel,=C2=A0<d= iv><br></div><div>We have an issue with Snort Unified2 output.</div><div>Sn= ort write packet record without write event record.=C2=A0</div><div>This is= sue happens=C2=A0frequently.=C2=A0</div><div><br></div><div>out snort versi= on is <b>2.9.11.1</b></div><div>Snort run on Ubuntu 16.04 Docker container<= /div><div><br></div><p style=3D"box-sizing:border-box;margin-bottom:16px;ma= rgin-top:0px;color:rgb(36,41,46);font-family:-apple-system,BlinkMacSystemFo= nt,"Segoe UI",Helvetica,Arial,sans-serif,"Apple Color Emoji&= quot;,"Segoe UI Emoji","Segoe UI Symbol";font-size:14px= ">We are would be grateful to any assistance.</p><div><span style=3D"color:= rgb(36,41,46);font-family:-apple-system,BlinkMacSystemFont,"Segoe UI&q= uot;,Helvetica,Arial,sans-serif,"Apple Color Emoji","Segoe U= I Emoji","Segoe UI Symbol";font-size:14px">Thanks!</span></d= iv><div>=C2=A0</div><div><br></div><div><div><br></div><div><br><div><br></= div><div><br></div></div></div></div> </blockquote></div> </blockquote></div> --00000000000063f332058dcf2c32-- --===============8939363774613093146== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Snort-devel mailing list [email protected] https://lists.snort.org/mailman/listinfo/snort-devel Please visit http://blog.snort.org for the latest news about Snort! --===============8939363774613093146==--