search

brimdata / zui

Zui is a powerful desktop application for exploring and working with data. The official front-end to the Zed lake.
https://www.brimdata.io/download/
Other
1.79k stars 129 forks source link

Suricata integration test #1210

Open henridf opened 3 years ago

henridf commented 3 years ago

Add a Suricata integration test, that minimally ingests a pcap and checks for the presence of alert logs in the Brim display.

philrz commented 3 years ago

While this test got created via #1207, it's been disabled for some time ("Skip for now since it consistently fails in CI", says a comment in itest/tests/ingest.test.ts). Suricata support in Brim is already released, so it's not great that we've got a known failure that's egregious enough that we can't tolerate the intermittently failing test. Alas, we've got lots of other priorities as well, so we can continue to hold this open as a reminder that we need to figure out the root cause, fix it, and enable the test.

philrz commented 2 years ago

In the time since this issue was last touched, it looks like the test lived for a while at a new path test/integration/tests/ingest.test.ts but then ultimately was deleted as part of the changes in #1985. As noted in https://github.com/brimdata/zed/issues/2016, there's now a Brimcap-level test of creating alerts from a pcap that seems to pass reliably, so it seems like it might be a reasonable time to revisit adding back some kind of end-to-end test that confirms Suricata continues working at the app layer.