Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Change Factoring for so-minion pcap disk space #12513

Merged
merged 10 commits into from
Mar 7, 2024
Merged

Change Factoring for so-minion pcap disk space #12513

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
10 commits
Select commit Hold shift + click to select a range
f58c104
Update so-minion
TOoSmOotH Mar 6, 2024
a63fca7
Update soc_suricata.yaml
TOoSmOotH Mar 6, 2024
f836d6a
Update so-minion
TOoSmOotH Mar 6, 2024
4dfa1a5
Move Suricata around
TOoSmOotH Mar 6, 2024
ad12093
Fix percent calc
TOoSmOotH Mar 6, 2024
9a413a2
Fix location of repo
TOoSmOotH Mar 6, 2024
7f1e786
Consolidate PCAP settings
TOoSmOotH Mar 6, 2024
cf23253
move suricata.pcap to suricata.config.outputs.pcap-log
m0duspwnens Mar 6, 2024
5832272
fix max-files calc
m0duspwnens Mar 6, 2024
70f3ce0
change how maxfiles is calculated
m0duspwnens Mar 6, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
Move Suricata around
  • Loading branch information
@TOoSmOotH
TOoSmOotH committed Mar 6, 2024
commit 4dfa1a5626387ab70c389565fa74a542cc44949b
5 changes: 3 additions & 2 deletions salt/suricata/defaults.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,8 @@
suricata:
enabled: False
pcap:
filesize: 1000mb
maxsize: 25
config:
threading:
set-cpu-affinity: "no"
Expand Down Expand Up @@ -132,9 +135,7 @@ suricata:
lz4-checksum: "no"
lz4-level: 8
filename: "%n/so-pcap.%t"
limit: "1000mb"
mode: "multi"
max-files: 10
use-stream-depth: "no"
conditional: "all"
dir: "/nsm/suripcap"
Expand Down
8 changes: 8 additions & 0 deletions salt/suricata/soc_suricata.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,6 +19,14 @@ suricata:
multiline: True
title: Classifications
helpLink: suricata.html
pcap:
filesize:
description: Max file size for individual PCAP files written by Suricata. Increasing this number could improve write performance at the expense of pcap retrieval times.
advanced: True
helplink: suricata.html
maxsize:
description: Size in GB for total usage size of PCAP on disk.
helplink: suricata.html
config:
af-packet:
interface:
Expand Down
Loading