securityonion-sostat: calculate suricata packet loss as percentage

[dougburks]

No description provided.

[dougburks]

for i in /nsm/sensor_data/*/stats.log; do
                echo "$i"
                if [ $( tail -n 50 $i | grep -c drop ) -ne 0 ]; then
                        echo
                        SURI_CAPTURE=`tail -n 50 "$i" | grep -m1 "capture.kernel_packets" | awk '{print $5}'`
                        SURI_DROPS=`tail -n 50 "$i" | grep -m1 "capture.kernel_drops" | awk '{print $5}'`
                        SURI_PCT=$(echo "scale=2 ; $SURI_DROPS * 10/$SURI_CAPTURE * 10" | bc)
                        echo $SURI_PCT% Loss
                        echo
                else
                        echo
                        echo "No packet drops reported."
                        echo
                fi
done

[dougburks]

The following package is now available at ppa:securityonion/test:

securityonion-sostat - 20120722-0ubuntu0securityonion135

Please test as follows:

• install the latest ISO image in a VM

• run Setup choosing Production Mode and then Suricata

• if possible, create a snapshot of the VM

• add the test PPA:

sudo add-apt-repository -y ppa:securityonion/test

• install updates:

sudo soup

• run sostat and verify that the Suricata section shows 0 loss:

sudo sostat

• create some Suricata drops by sending lots of traffic

• run sostat again and verify that the Suricata section now shows loss as a percentage:

sudo sostat

• verify no regressions

• anything else we missed?

Thanks in advance for your time and effort!

[weslambert]

After testing, it appears that we won't always get a consistent result only searching for the last 50 lines of output from stats.log. We should consider increasing to something like 100 to ensure we get through at least the last set of stats.

Ref:
https://github.com/Security-Onion-Solutions/securityonion-sostat/blob/master/bin/sostat#L207-L210

[dougburks]

OK, I've updated the code so that it now grabs the latest Suricata stats update in its entirety:
Security-Onion-Solutions/securityonion-sostat@4fbc516

securityonion-sostat - 20120722-0ubuntu0securityonion136 is now available for testing at ppa:securityonion/test.

[weslambert]

Just tested the updated package. Looks good 👍 !

[dougburks]

Published:
https://blog.securityonion.net/2019/11/securityonion-sostat-20120722_26.html