search

jasonish / evebox

Web Based Event Viewer (GUI) for Suricata EVE Events in Elastic Search
https://evebox.org/
MIT License
431 stars 67 forks source link

Agent can send too large of an event submission payload that is rejected by the server #248

Closed jasonish closed 1 year ago

malexe3169 commented 1 year ago

i've had this bug with one of my setup so far, and it generated a HUGE amount of bandwidth. in fact it maxed out the network. and no new event saved in the server once it is happening.

Is there a way to bypass it ?

jasonish commented 1 year ago

Unfortunately no way to get around this in the current release. The master branch has a fix though. You have to update the agent and the server. The server has increased its input size to 32mb, and the client will send a maximum size of 16mb. In practice the size is actually much smaller, but Suricata can generate some extremely large HTTP payloads in the eve.json which I found is the usual cause for this to start happening. Anyways, I force "push" events at a certain size now if that happens before either the timeout or event count limit is reached.

If you use Elasticsearch, you can update to the development releases without risk. I'll probably make these real releases very soon just because of this.

If using SQLite there is a schema migration that likely breaks backward compatibility.

jasonish commented 1 year ago

Already fixed in main branch which will become 0.17.0.