Differences

This shows you the differences between two versions of the page.

--- tips:suricata-eve-unixsocket [2020/09/10 16:28] – [2. Installing Suricata version 5.0] veera
+++ tips:suricata-eve-unixsocket [2020/09/28 17:22] (current) – navaneeth
@@ Line 22: / Line 22: @@
-===== Updating with latest ruleset =====
+==== 3. Updating with latest ruleset ====
 Use the following command to update the latest emerging-threats ruleset
@@ Line 32: / Line 32: @@
 <code>sudo chown trisul.trisul /var/lib/suricata -R </code>
-==== 3. Installing Emerging Threat Rules 5.0 ====
-  * You have to install the Emerging Threats Community which are a set of rules that trisul will listen to.
-  * Download and install Emerging Threats Open rules into ///etc/suricata//
-<code>#cd /etc/suricata
-#wget https://rules.emergingthreats.net/open/suricata-5.0.0/emerging.rules.tar.gz
-#tar xf emerging.rules.tar.gz
-</code>
-<note important>Please ensure that you run these commands as root</note>
 ==== 4. Enabling EVE_unix Socket ====
@@ Line 81: / Line 63: @@
 {{:tips:suricata-alert.png?600|}}
+==== 7. Starting Suricata Automatically ====
+  * You need to install [[monit:monitoring_and_maintain_trisul_process|monit]] to enable this feature.
+  * Add a shellscript named //start-suricata.sh// in ///usr/local/etc/trisul-probe///
+<code>
+#!/bin/bash
+echo "Removing PID file"
+/bin/rm -f /var/run/suricata.pid
+echo "Starting suricata"
+/usr/bin/suricata --user trisul -l /usr/local/var/lib/trisul-probe/domain0/probe0/context0/run -c /etc/suricata/suricata.yaml -i ens18 -D
+echo "Done starting suricata"</code>
+  * Make sure the shell script //start-suricata.sh// is executable. It can be done by
+<code>chmod +x start-suricata.sh</code>
+  * You need to add the following statements in the ///etc/monit/monitrc file//.
+<code>check process suricata with pidfile /var/run/suricata.pid
+  start program = "/usr/local/etc/trisul-probe/start-suricata.sh"
+</code>
+  * Please ensure you restart monit
+<code>systemctl restart monit</code>