Hi,
After the 18.1.4 update, suricata complains about syslogd. The log tab under IPS has never shown any entries other than "/var/log/suricata.log yielded no results". However, now I am getting an error with red letters!
In the release notes there is an item:
* intrusion detection: proper syslog with drops, requires log file reset
Are the two items related? Any directions on how to help suricata use /var/log/suricata.log and how to reset the log file are welcome.
Thanks!
What's your red letter alert if you don't mind sharing?
Yes, reset IDS log file and enable Syslog mode in IDS settings.
Cheers,
Franco