Added more logging to SuricataMessageManager

payneteasy · May 10, 2018 · b65077d · b65077d
1 parent c337539
commit b65077d
Showing 1 changed file with 8 additions and 3 deletions.
diff --git a/.../src/main/java/com/payneteasy/srvlog/adapter/syslog/surricata/SuricataMessageManager.java b/.../src/main/java/com/payneteasy/srvlog/adapter/syslog/surricata/SuricataMessageManager.java
@@ -31,12 +31,17 @@ public SuricataMessageManager(ILogCollector aCollector) {
     }
 
     public boolean isMessageFromSurricata(String aRawMessage) {
-        return aRawMessage.contains("suricata") && aRawMessage.contains("{");
+        return aRawMessage.contains("suricata") && aRawMessage.contains("{") && aRawMessage.contains("flow_id");
     }
 
     public void processRawMessage(String aRawMessage) {
         try {
-            collector.saveSnortLog(createSnortLogData(aRawMessage));
+            SnortLogData snortLogData = createSnortLogData(aRawMessage);
+            if(LOG.isDebugEnabled()) {
+                LOG.debug("Suricata raw message: {}", aRawMessage);
+                LOG.debug("Suricata snort log: {}",  snortLogData);
+            }
+            collector.saveSnortLog(snortLogData);
         } catch (IOException e) {
             LOG.error("Cannot process {}", aRawMessage, e);
         }
@@ -96,7 +101,7 @@ private SnortLogData convertToSnort(String aJson, SuricataJsonMessage aEvent) {
         SuricataAlert alert = aEvent.getAlert();
         SuricataHttp http  = aEvent.getHttp();
 
-        snort.setProgram           ( "surricata"                  );
+        snort.setProgram           ( "suricata"                   );
         snort.setSensorName        ( aEvent.getIn_iface()         );
         snort.setDate              ( aEvent.getTimestamp()        );
         snort.setPriority          ( alert.getSeverity()          ); // [Priority: 2 ]