worked poc

scripts/selftest.sh

@@ -24,17 +24,37 @@ if [ "$i" -ge 30 ]; then
   exit 3
 fi
 
+START_SIZE="$(docker compose exec -T ids python3 - <<'PY'
+import os
+print(os.path.getsize('/var/log/suricata/eve.json') if os.path.exists('/var/log/suricata/eve.json') else 0)
+PY
+)"
+START_SIZE="$(printf '%s' "$START_SIZE" | tr -d '\r\n ')"
+
 docker compose exec -T ids python3 /opt/ids/scripts/send_test_tzsp.py --host 127.0.0.1 --count 3
 sleep 3
 
-docker compose exec -T ids python3 - <<'PY'
+docker compose exec -T -e SELFTEST_START_SIZE="$START_SIZE" ids python3 - <<'PY'
 import json
-import urllib.request
+import os
 
-with urllib.request.urlopen('http://127.0.0.1:8080/api/alerts?limit=100', timeout=5) as r:
-    data = json.load(r)
-match = [a for a in data.get('alerts', []) if a.get('signature_id') == 1000001]
-if not match:
-    raise SystemExit('SELFTEST FAILED: SID 1000001 not found')
-print('SELFTEST OK: Suricata emitted LOCAL TZSP PIPELINE TEST')
+path = '/var/log/suricata/eve.json'
+start = int(os.environ.get('SELFTEST_START_SIZE', '0'))
+found = 0
+with open(path, 'r', encoding='utf-8', errors='replace') as handle:
+    try:
+        handle.seek(start)
+    except OSError:
+        handle.seek(0)
+    for line in handle:
+        try:
+            event = json.loads(line)
+        except json.JSONDecodeError:
+            continue
+        alert = event.get('alert') or {}
+        if alert.get('signature_id') == 1000001:
+            found += 1
+if not found:
+    raise SystemExit('SELFTEST FAILED: Suricata did not emit reserved SID 1000001')
+print(f'SELFTEST OK: Suricata emitted {found} marked TZSP pipeline test alert(s); UI filtering remains enabled')
 PY