Setting up Suricata IDS on RHEL

Suricata Logs and Output Configuration

Suricata generates a variety of logs to provide insights into network activity, detected threats, and system performance. Configuring Suricata’s logs and output is crucial for monitoring and analysis. Below are the key configurations and methods for handling Suricata logs:

1. Suricata Log Types

Suricata generates several types of log files based on the configuration. The primary log files are:

• suricata.log: General log file containing startup information, errors, and status updates.
• eve.json: Detailed event logs in JSON format, including alerts, flow information, and performance metrics.
• stats.json: Provides statistical data about Suricata’s performance, including packet processing rates.
• alerts.log: Contains alert messages triggered by rules.

2. Configuring Log Directories and Files

To configure where Suricata saves its logs, you need to edit the suricata.yaml configuration file. This file defines the log output directories and formats. Below is an example configuration for logs:

logging:
  default-log-dir: /var/log/suricata
  outputs:
    - file:
        enabled: yes
        filename: suricata.log
    - eve-json:
        enabled: yes
        filename: eve.json
        append: yes
        community-id: yes

Here’s what each option means:

• default-log-dir: Defines the directory where Suricata saves log files.
• outputs: Specifies different output formats and filenames. Suricata supports several types of log outputs (e.g., plain text, JSON, etc.).
• eve-json: A JSON-formatted log that provides detailed information, including alerts.
• append: Determines whether the log file is appended or overwritten when Suricata restarts.

3. Log Rotation

To prevent log files from growing indefinitely, it’s important to configure log rotation. On most systems, you can use logrotate to manage this. Create a configuration file in /etc/logrotate.d/ for Suricata:

sudo vi /etc/logrotate.d/suricata

Here’s an example logrotate configuration:

/var/log/suricata/*.log {
    daily
    missingok
    rotate 7
    compress
    delaycompress
    notifempty
    create 0640 suricata suricata
}

This will rotate Suricata logs daily, keep the last 7 logs, and compress older logs to save space.

4. Enabling EVE Output

The eve.json log file is often used for detailed logging, including alerts, HTTP logs, DNS logs, and more. To enable this output, you need to ensure that the appropriate sections in suricata.yaml are uncommented and configured correctly. Example:

outputs:
  - eve-json:
      enabled: yes
      filename: /var/log/suricata/eve.json
      community-id: yes
      append: yes
      xff:
        enabled: yes
        depth: 1
      alert:
        enabled: yes
        filename: /var/log/suricata/eve-alert.json

This configuration will enable event logging to the eve.json file and will include alerts. It also provides features like community-id (for unique event IDs) and xff (for handling the X-Forwarded-For header in HTTP traffic).

5. Viewing Logs

After configuring Suricata logs, you can view them using the tail command. For example, to view the real-time output of the eve.json log file:

sudo tail -f /var/log/suricata/eve.json

You can also use other tools like jq to parse and filter JSON logs:

cat /var/log/suricata/eve.json | jq .

6. Log File Permissions

Ensure that Suricata has appropriate file permissions to write logs to the specified directories. For example:

sudo chown -R suricata:suricata /var/log/suricata
sudo chmod -R 750 /var/log/suricata

This ensures that only the Suricata user can write to the logs and that others have restricted access.

Troubleshooting Common Suricata Issues

When working with Suricata, you may encounter various issues. Below are some common problems and troubleshooting tips to help resolve them:

1. Suricata Not Starting

If Suricata fails to start, it’s important to check the status and logs for errors.

Solution:

• Check the systemd status of the Suricata service:

  sudo systemctl status suricata

  Look for any error messages or hints in the output.

• Review Suricata’s log file for errors:

  sudo tail -f /var/log/suricata/suricata.log

  Ensure that the configuration file is correct by running the configuration test:

  sudo suricata -T -c /etc/suricata/suricata.yaml
  

  This will check for syntax errors in the config file.

2. High CPU or Memory Usage

Suricata can be resource-intensive, especially with high network traffic. High CPU or memory usage could affect the performance of your system.

Solution:

• Use the top or htop command to check resource usage:

  top

  or

  htop

• Adjust the number of worker threads in the suricata.yaml configuration file. The threads setting controls how many CPU cores Suricata uses.

  af-packet:
    threads: 4
  

• Optimize Suricata’s performance by adjusting rules. Disable unnecessary or overly broad rules in the suricata.yaml file under the rule-files section

3. Missing or Incorrect Alerts

If you are not seeing alerts in your eve.json or alerts.log, it could be due to misconfiguration or missing rules.

Solution:

• Ensure that Suricata is properly configured to log alerts: Check the suricata.yaml file under the outputs section:

  outputs:
    - eve-json:
        enabled: yes
        filename: /var/log/suricata/eve.json
        alert:
          enabled: yes

• Verify that the correct rules are loaded: Check the rule-files section in the suricata.yaml configuration file to ensure the necessary rules are being loaded.
• Check the rules directory to make sure that the rule files are up to date and not empty.

  ls /etc/suricata/rules/
  

• Test the rule set by generating known traffic (e.g., a port scan) to see if Suricata generates an alert.

4. Suricata Log Rotation Not Working

If Suricata logs are not rotating, it may be due to improper logrotate configuration.

Solution:

• Ensure that you have a proper logrotate configuration for Suricata. Verify that the configuration file exists in /etc/logrotate.d/suricata.
• Ensure that the logrotate service is running:

  sudo systemctl status logrotate
  

• Manually trigger log rotation to test it:

  sudo logrotate /etc/logrotate.d/suricata

5. Network Interface Not Detected

If Suricata is unable to detect your network interface, it may be because the interface is not specified correctly in the configuration.

Solution:

• Verify that the correct interface is specified in the suricata.yaml file under the af-packet or pfring section:

  af-packet:
    - interface: eth0
  

• Ensure that the network interface is up and available using the ip a command:

  ip a

  If the interface is down, bring it up with:

  sudo ip link set eth0 up
  

6. Suricata Performance Degradation

Performance degradation can occur if Suricata is overloaded or improperly configured.

Solution:

• Review the Suricata performance tuning parameters in the suricata.yaml file:
  • Increase the number of threads under the af-packet section.
  • Adjust the max-pending-packets and max-pending-flows settings.
• Consider using a more optimized mode for high-volume environments, such as --dpdk or --nfq, for faster packet processing.
• Use suricata -v to check the version and ensure you are using the latest stable release of Suricata.