-
Notifications
You must be signed in to change notification settings - Fork 94
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Add "show-defaults" command #150
base: master
Are you sure you want to change the base?
Conversation
Add a command "show-defaults" that shows current default configuration for suricata-update. Sample ``` └─ $ ▶ ./bin/suricata-update --show-defaults 13/5/2019 -- 16:47:48 - <Info> -- Loading /etc/suricata/update.yaml 13/5/2019 -- 16:47:48 - <Info> -- Using data-directory /var/lib/suricata. 13/5/2019 -- 16:47:48 - <Info> -- Using Suricata configuration /etc/suricata/suricata.yaml 13/5/2019 -- 16:47:48 - <Info> -- Using /etc/suricata/rules for Suricata provided rules. disable-conf /etc/suricata/disable.conf enable-conf /etc/suricata/enable.conf drop-conf /etc/suricata/drop.conf modify-conf /etc/suricata/modify.conf sources Not set local Not set ignore *deleted.rules subcommand update show-defaults 1 ```
for i in conf_val: | ||
print("{:>30}{}".format("", i)) | ||
else: | ||
print(row_format.format(conf_key, conf_val if conf_val else "Not set")) |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
hmm this should not have the internal information like "subcommand". Needs a spin.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
On second thoughts, this is probably a redundant feature. -v
gives most of the required information and now we even have an --offline
option in case we do not want to update the rules while getting this info.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I could live without this feature. But its not a bad feature. Some command with the following output could be useful:
Using Suricata: /usr/bin/suricata
Using Suricata configuration file: /etc/suricata/suricata.yaml
Config files Suricata-update would load...
Writing rules to ....
Thats pretty rough, but gets the idea across.
Another idea would be a --dry-run
that goes through all the motions, but doesn't actually do anything. Could be tricky though.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Should the --dry-run
feature be implemented instead then?
Add a command "show-defaults" that shows current default configuration
for suricata-update.
Sample
Link to redmine ticket: https://redmine.openinfosecfoundation.org/issues/2938