Re: Unified2 Missing event record

--===============6750540358294394344==
Content-Type: multipart/alternative; boundary="00000000000047aeee058dcf5cde"

--00000000000047aeee058dcf5cde
Content-Type: text/plain; charset="UTF-8"

Hi Albert,
I running Snort as IDS  in inline mode - Using Daq PFRING ZC mode.

*Snort Command: *
snort -c snort.conf --daq-dir /usr/local/lib/daq --daq-mode passive --daq
pfring_zc -i zc:100@0

*Snort configuration:*
 My snort configuration download from snort.com website and compatible with
my snort version (2.9.11.1)

*Unified2 configuraton in snort.conf:*
output unified2: filename /usr/local/app/snort/unified2/snort.unifed2,
limit 100M

I will check if issue happening on the most recent version of snort.

Thanks,
Ron. :)





On Tue, Jul 16, 2019 at 7:50 PM Ron H <[email protected]> wrote:

> More details:
> Our application creates pcaps files from unified2 snort output.
> The application read unified2 records (Event record and Packet record)
> The issue is Snort writes unifed2 files frequently without event record
> (Only Packet record)
>
> This situation can be normal?
>
> Thanks,
> Ron :)
>
>
> On Tue, Jul 16, 2019 at 7:42 PM Ron H <[email protected]> wrote:
>
>> UP! :)
>> Does someone know this issue?
>>
>> On Mon, Jul 8, 2019 at 7:31 PM Ron H <[email protected]> wrote:
>>
>>> Hey Snort devel,
>>>
>>> We have an issue with Snort Unified2 output.
>>> Snort write packet record without write event record.
>>> This issue happens frequently.
>>>
>>> out snort version is *2.9.11.1*
>>> Snort run on Ubuntu 16.04 Docker container
>>>
>>> We are would be grateful to any assistance.
>>> Thanks!
>>>
>>>
>>>
>>>
>>>
>>>
>>>

--00000000000047aeee058dcf5cde
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">Hi Albert,=C2=A0<div>I running Snort as IDS=C2=A0 in inlin=
e mode - Using Daq PFRING ZC mode.</div><div><br></div><div><b>Snort Comman=
d:=C2=A0</b></div><div>snort -c snort.conf --daq-dir /usr/local/lib/daq --d=
aq-mode passive --daq pfring_zc -i zc:100@0</div><div>=C2=A0</div><div><b>S=
nort configuration:</b></div><div>=C2=A0My snort configuration download fro=
m <a href=3D"http://snort.com">snort.com</a> website and compatible with my=
 snort version (2.9.11.1)</div><div><br></div><div><b>Unified2 configuraton=
 in snort.conf:</b></div><div>output unified2: filename /usr/local/app/snor=
t/unified2/snort.unifed2, limit 100M</div><div><br></div><div>I will check =
if issue happening on the most recent version of snort.</div><div><br></div=
><div>Thanks,</div><div>Ron. :)</div><div><br></div><div><br></div><div><br=
></div><div><br></div></div><br><div class=3D"gmail_quote"><div dir=3D"ltr"=
 class=3D"gmail_attr">On Tue, Jul 16, 2019 at 7:50 PM Ron H &lt;<a href=3D"=
mailto:[email protected]">[email protected]</a>&gt; wrote:<br></div><bl=
ockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-lef=
t:1px solid rgb(204,204,204);padding-left:1ex"><div dir=3D"ltr">More detail=
s:<div>Our application creates pcaps files from unified2 snort output.</div=
><div>The application read unified2 records (Event record and Packet record=
)</div><div>The issue is Snort writes unifed2 files frequently without even=
t record (Only Packet record)</div><div><br></div><div>This situation can b=
e normal?=C2=A0</div><div><br></div><div>Thanks,</div><div>Ron :)</div><div=
>=C2=A0</div></div><br><div class=3D"gmail_quote"><div dir=3D"ltr" class=3D=
"gmail_attr">On Tue, Jul 16, 2019 at 7:42 PM Ron H &lt;<a href=3D"mailto:ro=
[email protected]" target=3D"_blank">[email protected]</a>&gt; wrote:<br>=
</div><blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;b=
order-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir=3D"ltr">UP=
! :)=C2=A0<div>Does someone know this issue?=C2=A0</div></div><br><div clas=
s=3D"gmail_quote"><div dir=3D"ltr" class=3D"gmail_attr">On Mon, Jul 8, 2019=
 at 7:31 PM Ron H &lt;<a href=3D"mailto:[email protected]" target=3D"_bla=
nk">[email protected]</a>&gt; wrote:<br></div><blockquote class=3D"gmail_=
quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,=
204);padding-left:1ex"><div dir=3D"ltr">Hey Snort devel,=C2=A0<div><br></di=
v><div>We have an issue with Snort Unified2 output.</div><div>Snort write p=
acket record without write event record.=C2=A0</div><div>This issue happens=
=C2=A0frequently.=C2=A0</div><div><br></div><div>out snort version is <b>2.=
9.11.1</b></div><div>Snort run on Ubuntu 16.04 Docker container</div><div><=
br></div><p style=3D"box-sizing:border-box;margin-bottom:16px;margin-top:0p=
x;color:rgb(36,41,46);font-family:-apple-system,BlinkMacSystemFont,&quot;Se=
goe UI&quot;,Helvetica,Arial,sans-serif,&quot;Apple Color Emoji&quot;,&quot=
;Segoe UI Emoji&quot;,&quot;Segoe UI Symbol&quot;;font-size:14px">We are wo=
uld be grateful to any assistance.</p><div><span style=3D"color:rgb(36,41,4=
6);font-family:-apple-system,BlinkMacSystemFont,&quot;Segoe UI&quot;,Helvet=
ica,Arial,sans-serif,&quot;Apple Color Emoji&quot;,&quot;Segoe UI Emoji&quo=
t;,&quot;Segoe UI Symbol&quot;;font-size:14px">Thanks!</span></div><div>=C2=
=A0</div><div><br></div><div><div><br></div><div><br><div><br></div><div><b=
r></div></div></div></div>
</blockquote></div>
</blockquote></div>
</blockquote></div>

--00000000000047aeee058dcf5cde--

--===============6750540358294394344==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Snort-devel mailing list
[email protected]
https://lists.snort.org/mailman/listinfo/snort-devel

Please visit http://blog.snort.org for the latest news about Snort!

--===============6750540358294394344==--