suricata interface None if so-import

Security-Onion-Solutions · Nov 22, 2023 · 1dc8878 · 1dc8878
1 parent 0cfb8b0
commit 1dc8878
Showing 1 changed file with 1 addition and 5 deletions.
diff --git a/salt/suricata/afpacket.map.jinja b/salt/suricata/afpacket.map.jinja
@@ -1,15 +1,11 @@
 {% load_yaml as afpacket %}
 af-packet:
-  - interface: {{ salt['pillar.get']('sensor:interface', 'bond0') }}
+  - interface: {{ None if grains.role == 'so-import' else salt['pillar.get']('sensor:interface', 'bond0') }}
     cluster-id: 59
     cluster-type: cluster_flow
     defrag: yes
     use-mmap: yes
     threads: {{ salt['pillar.get']('sensor:suriprocs', salt['pillar.get']('sensor:suripins') | length) }}
     tpacket-v3: yes
     ring-size: {{ salt['pillar.get']('sensor:suriringsize', '5000') }}
-  - interface: default
-    #threads: auto
-    #use-mmap: no
-    #tpacket-v3: yes
 {% endload %}