NAME

suricata_extract_submit_extend - Provides a LibreNMS style SNMP extend for suricata_extract_submit stats

VERSION

0.1.0

SYNOPSIS

extend suricata-extract /usr/local/bin/suricata_extract_submit_extend

SWITCHES

-Z

Do not use conditional GZip+BASE64 compression.

-c <stats file>

The stats file created by suricata_extract_submit.

Default :: /var/cache/suricata_extract_submit_stats.json

-d <stats dir>

The stats used by suricata_extract_submit.

Default :: /var/cache/suricata_extract_submit_stats

-r <seconds>

The number of seconds to look back buy for generating stats.

Default :: 300

-h|--help

Print help info.

-v|--version

Print version info.

Generated JSON

The generated JSON is a standard LibreNMS style return. For more information on that see https://docs.librenms.org/Developing/Application-Notes/.

All stat keys come in counter and gauge variety. The gauge variety has '_delta' appended to the name and a count of just those items for the time period in question.

General Data Keys...

    - timestamp :: Epoch time it was generated at.

    - last_errors :: A array containing encounted errors.

Stat Keys...

    - errors :: Number of general errors encounted.

    - ignored_host :: Files skipped as the host in question is set to be ignored.

    - ignored_ip :: Files skipped as either the src or dest IP/subnet is set to be ignored.

    - ignored_ip_dest :: Files skipped as either the dest IP/subnet is set to be ignored.

    - ignored_ip_src :: Files skipped as either the src IP/subnet is set to be ignored.

    - sub :: Files submitted.

    - sub_2xx :: Submissions with a 2xx HTTP status code result.

    - sub_3xx :: Submissions with a 3xx HTTP status code result.

    - sub_4xx :: Submissions with a 4xx HTTP status code result.

    - sub_5xx :: Submissions with a 5xx HTTP status code result.

    - sub_fail :: Submissions that have failed.

    - sub_size :: Total size of submissions in bytes.

    - truncated :: Files which are truncated as Suricata did not have all the packets.

    - zero_sized :: Files which are zero in size and thus ignored.