show total number of active drop and alert rules

[sol]

Hi there,

How can I list the total number of active drop and alert rules?
Is it possible in the gui or are there any commands for the shell.

Thx.

[MTR]

Count all enabled rules:

Code: [Select]

# sqlite3 -readonly /usr/local/etc/suricata/rules/rules.sqlite "SELECT COUNT(*) FROM rules WHERE enabled = True;"
Count only enabled 'drop' rules:

Code: [Select]

# sqlite3 -readonly /usr/local/etc/suricata/rules/rules.sqlite "SELECT COUNT(*) FROM rules WHERE enabled = True AND action LIKE 'drop';"
Count only enabled 'alert' rules:

Code: [Select]

# sqlite3 -readonly /usr/local/etc/suricata/rules/rules.sqlite "SELECT COUNT(*) FROM rules WHERE enabled = True AND action LIKE 'alert';"

[sol]

Perfect!
Thank you very much!

[MTR]

You're welcome.