DOKK / manpages / debian 10 / suricata / suricatasc.1.en
SURICATASC(1) General Commands Manual SURICATASC(1)

suricatasc - client for Suricata unix socket

suricatasc -h] [-v] [-c COMMAND] [socket]

This manual page documents briefly the suricatasc command.

suricatasc is a Python script that allows you communicate with suricata(8) daemon using standard Unix sockets. The exchange protocol is JSON-based.

The creation of the socket is activated by setting enabled: yes under unix-command in Suricata YAML configuration file:

[...]
unix-command:
enabled: yes
filename: /var/run/suricata-command.socket
[...]

You can also start suricata(8) with the --unix-socket argument:

suricata --unix-socket
suricata --unix-socket=socket

In case you don't specify socket, the default is /var/run/suricata-command.socket.

To know if the suricata(8) daemon is build with the required capabilities run suricata --build-info and look for "Unix socket enabled: yes".

The program follows the usual GNU command line syntax, with long options starting with two dashes (`-'). A summary of options is included below.

Show summary of options.

Verbose output (including JSON dump).

Execute a single COMMAND and return a JSON result (see below for possible commands).

You can use suricatasc in two modes:

* one shot command
* interactive CLI

The list of available commands is:

this shutdown suricata
list available commands
alias of command-list
display Suricata's version
display Suricata's uptime
display running mode (workers, autofp, simple)
display capture system used
get configuration item.

>>> conf-get unix-command.enabled
Success:
"yes"

dump Suricata's performance counters
suricata will reload the rulesets
register a tenant handler
the inverse of the above
register a tenant
reload a tenant
unregister a tenant
show interface stats
show interfaces list
load a file for pcap treatment
to know how much files are waiting to get processed
list of queued files
the current processed file

suricata(8)

suricatasc was written by the Open Information Security Foundation.

This man page was written by Arturo Borrero Gonzalez <arturo@debian.org> for the Debian GNU/Linux distribution (but it may be used by others).

10 Oct 2016