Saturday, August 1, 2020

suricata

sudo apt-get remove suricata
sudo apt-get remove suricata
Reading package lists... Done
Building dependency tree       
Reading state information... Done
The following packages were automatically installed and are no longer required:
  libevent-core-2.1-7 libevent-pthreads-2.1-7 libhiredis0.14 libhtp2 libhyperscan5 libluajit-5.1-2 libluajit-5.1-common liblzma-dev libnet1 libnetfilter-queue1
Use 'sudo apt autoremove' to remove them.
The following packages will be REMOVED:
  suricata
0 upgraded, 0 newly installed, 1 to remove and 0 not upgraded.
After this operation, 6,401 kB disk space will be freed.
Do you want to continue? [Y/n] y
(Reading database ... 179313 files and directories currently installed.)
Removing suricata (5.0.3-0ubuntu0) ...
Processing triggers for man-db (2.9.1-1) ...


suricata -T
1/8/2020 -- 21:07:39 - <Info> - Running suricata under test mode
Error opening file /var/log/suricata//suricata.log
1/8/2020 -- 21:07:39 - <Notice> - This is Suricata version 5.0.3 RELEASE running in SYSTEM mode
1/8/2020 -- 21:07:39 - <Error> - [ERRCODE: SC_ERR_LOGDIR_CONFIG(116)] - The logging directory "/var/log/suricata/" supplied by /etc/suricata//suricata.yaml (default-log-dir) doesn't exist. Shutting down the engine

suricata -h
Suricata 5.0.3
USAGE: suricata [OPTIONS] [BPF FILTER]

-c <path>                            : path to configuration file
-T                                   : test configuration file (use with -c)
-i <dev or ip>                       : run in pcap live mode
-F <bpf filter file>                 : bpf filter file
-r <path>                            : run in pcap file/offline mode
-q <qid[:qid]>                       : run in inline nfqueue mode (use colon to specify a range of queues)
-s <path>                            : path to signature file loaded in addition to suricata.yaml settings (optional)
-S <path>                            : path to signature file loaded exclusively (optional)
-l <dir>                             : default log directory
-D                                   : run as daemon
-k [all|none]                        : force checksum check (all) or disabled it (none)
-V                                   : display Suricata version
-v                                   : be more verbose (use multiple times to increase verbosity)
--list-app-layer-protos              : list supported app layer protocols
--list-keywords[=all|csv|<kword>]    : list keywords implemented by the engine
--list-runmodes                      : list supported runmodes
--runmode <runmode_id>               : specific runmode modification the engine should run.  The argument
                                       supplied should be the id for the runmode obtained by running
                                       --list-runmodes
--engine-analysis                    : print reports on analysis of different sections in the engine and exit.
                                       Please have a look at the conf parameter engine-analysis on what reports
                                       can be printed
--pidfile <file>                     : write pid to this file
--init-errors-fatal                  : enable fatal failure on signature init error
--disable-detection                  : disable detection engine
--dump-config                        : show the running configuration
--build-info                         : display build information
--pcap[=<dev>]                       : run in pcap mode, no value select interfaces from suricata.yaml
--pcap-file-continuous               : when running in pcap mode with a directory, continue checking directory for pcaps until interrupted
--pcap-file-delete                   : when running in replay mode (-r with directory or file), will delete pcap files that have been processed when done
--pcap-buffer-size                   : size of the pcap buffer value from 0 - 2147483647
--af-packet[=<dev>]                  : run in af-packet mode, no value select interfaces from suricata.yaml
--simulate-ips                       : force engine into IPS mode. Useful for QA
--user <user>                        : run suricata as this user after init
--group <group>                      : run suricata as this group after init
--erf-in <path>                      : process an ERF file
--unix-socket[=<file>]               : use unix socket to control suricata work
--set name=value                     : set a configuration value


To run the engine with default configuration on interface eth0 with signature file "signatures.rules", run the command as:

suricata -c suricata.yaml -s signatures.rules -i eth0