Suricata rules - one borks, but which one?

[ejgh-oe]

Version

3.1.0

Installation Method

Security Onion ISO image

Description

configuration

Installation Type

Distributed

Location

on-prem with Internet access

Hardware Specs

Exceeds minimum requirements

CPU

16

RAM

32

Storage for /

500GB

Storage for /nsm

5TB

Network Traffic Collection

span port

Network Traffic Speeds

1Gbps to 10Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

Looking at the grid status just found out that one of ~56.000 rules seems to have a problem:

Since we've got around 100 custom rules I assume the problem is related to any of those custom rules (?) - but how do I find out which one is causing the problems?

Thanks in advance for any clue...

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.

[cm-ops]

On a sensor node, look at /opt/so/log/suricata/suricata.log that should indicate which rule is the failed one.

[ejgh-oe]

On a sensor node, look at /opt/so/log/suricata/suricata.log that should indicate which rule is the failed one.

Thanks - that's exactly what I was looking for.