suricata ops

quick hints

update and reload rules

suricata-update
kill -USR2 `cat /var/run/suricata.pid 2>/dev/null`

rotate logs – to include within the scheduled log rotation script after rotating log files

kill -HUP `cat /var/run/suricata.pid 2>/dev/null`

basic checks

    ls -lF /var/log/suricata/
    cat /var/log/suricata/suricata-start.log
    tail -F /var/log/suricata/suricata.log

systemd

cp -pi /etc/default/suricata /etc/default/suricata.dist
    vi /etc/default/suricata

    IFACE=NIC-HERE

    systemctl restart suricata
    systemctl status suricata
    journalctl -xeu suricata

old school

start & enable

    vi /etc/rc.local

    #!/bin/bash

    PATH=/usr/local/sbin:/usr/local/bin:$PATH

    ifconfig wg0 && suricata --af-packet -D -i wg0
    # --init-errors-fatal
    # -c /etc/suricata/suricata.yaml (default)
    # --pidfile /var/run/suricata.pid (default)
    # -vvv
# --user=suri

    chmod +x /etc/rc.local
systemctl list-unit-files | grep rc-local

reload

HUP doesn’t seem to work here

kill -HUP `cat /var/run/suricata.pid`

status

socket shows up after some time

    ps auxww | grep suricata
    ls -lF /var/run/suricata.pid
    ls -lF /var/run/suricata/*

stop

forget about kill and pkill

    suricatasc -c shutdown
    #pkill -9 suricata
    #ps auxww | grep suricata
    #rm -f /var/run/suricata.pid

update rules

date
ls -lhF /var/lib/suricata/rules/suricata.rules
grep 2200003 /var/lib/suricata/rules/suricata.rules

    suricatasc -c reload-rules
    #reload-rules, ruleset-reload-rules, ruleset-reload-nonblocking

resources

https://suricata.readthedocs.io/en/suricata-4.1.2/unix-socket.html ==> suricatasc