Scroll to navigation

SURICATASC(1) Suricata SURICATASC(1)

NAME

suricatasc - Tool to interact via unix socket

SYNOPSIS

suricatasc

DESCRIPTION

Suricata socket control tool

COMMANDS

Shut Suricata instance down.

List available commands.

Get help about the available commands.

Print the version of Suricata instance.

Display the uptime of Suricata.

Display running mode. This can either be workers, autofp or single.

Display the capture mode. This can be either of PCAP_DEV, PCAP_FILE, PFRING(DISABLED), NFQ, NFLOG, IPFW, ERF_FILE, ERF_DAG, AF_PACKET_DEV, NETMAP(DISABLED), UNIX_SOCKET or WINDIVERT(DISABLED).

Get configuration value for a given variable. Variable to be provided can be either of the configuration parameters that are written in suricata.yaml.

Dump Suricata’s performance counters.

Reload the ruleset and wait for completion.

Alias .. describe ruleset-reload-rules.

Reload ruleset and proceed without waiting.

Return time of last reload.

Display the number of rules loaded and failed.

Display the list of failed rules.

Register a tenant handler with the specified mapping.

Unregister a tenant handler with the specified mapping.

Register tenant with a particular ID and filename.

Reload a tenant with specified ID and filename.

Unregister tenant with a particular ID.

Add hostbit on a host IP with a particular bit name and time of expiry.

Remove hostbit on a host IP with specified IP address and bit name.

List hostbit for a particular host IP.

Reopen log files to be run after external log rotation.

Update memcap value of a specified item.

Show memcap value of a specified item.

List all memcap values available.

PCAP MODE COMMANDS

Add pcap files to Suricata for sequential processing. The generated log/alert files will be put into the directory specified as second argument. Make sure to provide absolute path to the files and directory. It is acceptable to add multiple files without waiting the result.

Add pcap files to Suricata for sequential processing. Directory will be monitored for new files being added until there is a use of pcap-interrupt or directory is moved or deleted.

Number of pcap files waiting to get processed.

List of queued pcap files.

Processed time of last file in milliseconds since epoch.

Terminate the current state by interrupting directory processing.

Currently processed file.

BUGS

Please visit Suricata’s support page for information about submitting bugs or feature requests.

NOTES

•
Suricata Home Page
https://suricata.io/


•
Suricata Support Page
https://suricata.io/community/



COPYRIGHT

2016-2023, OISF

January 31, 2023 6.0.10