show total number of active drop and alert rules

[sol]

Hi there,

How can I list the total number of active drop and alert rules?
Is it possible in the gui or are there any commands for the shell.

Thx.

[MTR]

Count all enabled rules:

Code Select Expand

# sqlite3 -readonly /usr/local/etc/suricata/rules/rules.sqlite "SELECT COUNT(*) FROM rules WHERE enabled = True;"

Count only enabled 'drop' rules:

Code Select Expand

# sqlite3 -readonly /usr/local/etc/suricata/rules/rules.sqlite "SELECT COUNT(*) FROM rules WHERE enabled = True AND action LIKE 'drop';"

Count only enabled 'alert' rules:

Code Select Expand

# sqlite3 -readonly /usr/local/etc/suricata/rules/rules.sqlite "SELECT COUNT(*) FROM rules WHERE enabled = True AND action LIKE 'alert';"

[sol]

Perfect!
Thank you very much!

[MTR]

You're welcome.  :)