Telegraf - Fix Suri script so it requires 2 drops in a row

salt/common/telegraf/scripts/suriloss.sh

@@ -1,15 +1,21 @@
 #!/bin/bash
 
 SURILOG=$(tac /var/log/suricata/stats.log | grep kernel | head -4)
-declare RESULT=($SURILOG)
+CHECKIT=$(echo $SURILOG | grep drop | wc -l)
 
-CURRENTDROP=${RESULT[4]}
-PASTDROP=${RESULT[14]}
-DROPPED=$(($CURRENTDROP - $PASTDROP))
+if [ $CHECKIT == 2 ]; then
+  declare RESULT=($SURILOG)
 
-CURRENTPACKETS=${RESULT[9]}
-PASTPACKETS=${RESULT[19]}
-TOTAL=$(($CURRENTPACKETS - $PASTPACKETS))
+  CURRENTDROP=${RESULT[4]}
+  PASTDROP=${RESULT[14]}
+  DROPPED=$(($CURRENTDROP - $PASTDROP))
 
-LOSS=$(echo $DROPPED $TOTAL / p | dc)
-echo "suridrop drop=$LOSS"
+  CURRENTPACKETS=${RESULT[9]}
+  PASTPACKETS=${RESULT[19]}
+  TOTAL=$(($CURRENTPACKETS - $PASTPACKETS))
+
+  LOSS=$(echo $DROPPED $TOTAL / p | dc)
+  echo "suridrop drop=$LOSS"
+else
+  echo "suridrop drop=0"
+fi

salt/suricata/files/suricata.yaml

@@ -77,7 +77,7 @@ stats:
   enabled: yes
   # The interval field (in seconds) controls at what interval
   # the loggers are invoked.
-  interval: 8
+  interval: 30
 
 # Configure the type of alert (and other) logging you would like.
 outputs: