Add another pcap job fp

Update excluded errors in so-log-check script
Add fp check
2026-08-14 19:57:01 +02:00 · 2026-08-14 13:54:14 -04:00 · 2026-08-14 11:23:25 -04:00 · 2026-08-14 11:22:12 -04:00 · 2026-08-14 09:49:28 -04:00
1 changed files with 2 additions and 0 deletions
@@ -154,6 +154,8 @@ if [[ $EXCLUDE_FALSE_POSITIVE_ERRORS == 'Y' ]]; then
    EXCLUDED_ERRORS="$EXCLUDED_ERRORS|id.orig_h"                    # false positive (zeek test data)
    EXCLUDED_ERRORS="$EXCLUDED_ERRORS|emerging-all.rules"           # false positive (error in rulename)
    EXCLUDED_ERRORS="$EXCLUDED_ERRORS|invalid query input"          # false positive (Invalid user input in hunt query)
+    EXCLUDED_ERRORS="$EXCLUDED_ERRORS|no data available for the requested dates" # false positive (pcap cypress test submits a job with an empty time frame)
+    EXCLUDED_ERRORS="$EXCLUDED_ERRORS|no job processor"             # false positive (same empty-time-frame job on import nodes, where no pcap processor runs)
    EXCLUDED_ERRORS="$EXCLUDED_ERRORS|example"                      # false positive (example test data)
    EXCLUDED_ERRORS="$EXCLUDED_ERRORS|status 200"                   # false positive (request successful, contained error string in content)
    EXCLUDED_ERRORS="$EXCLUDED_ERRORS|app_layer.error"              # false positive (suricata 7) in stats.log e.g. app_layer.error.imap.parser | Total | 0
Author	SHA1	Message	Date
Josh Brower	c4555a5514	Add another pcap job fp	2026-08-14 13:54:14 -04:00
Josh Brower	dcb931b97c	Update excluded errors in so-log-check script	2026-08-14 11:23:25 -04:00
Josh Brower	8e6b16bde0	Add fp check	2026-08-14 11:22:12 -04:00
Josh Patterson	63692aa1a0	Merge pull request #16159 from Security-Onion-Solutions/fix/zeekctl-cron Run zeekctl cron so LogExpireInterval and the other expire settings take effect	2026-08-14 09:49:28 -04:00