CentoOS7.5下編譯suricata-5.0.3及簡單使用
一、安裝
參考官方文檔：https://redmine.openinfosecfoundation.org/projects/suricata/wiki/CentOS_Installation
1、安裝依賴庫：yum -y install gcc libpcap-devel pcre-devel libyaml-devel file-devel
zlib-devel jansson-devel nss-devel libcap-ng-devel libnet-devel tar make
libnetfilter_queue-devel lua-devel PyYAML libmaxminddb-devel rustc cargo
lz4-devel
2、rustc cargo需要依賴：epel
yum install epel-release -y
yum install rustc cargo
3、下載源碼後解壓->編譯->安裝
（1）wget http://www.openinfosecfoundation.org/download/suricata-5.0.3.tar.gz
（2）tar -xvzf suricata-5.0.3.tar.gz
（3）cd suricata-5.0.3
（4）./configure --prefix=/usr --sysconfdir=/etc --localstatedir=/var --enable-nfqueue --enable-lua
（5）make
（6）make install-full
4、拷貝依賴庫libhtp到 /lib64/目錄下：ldd /usr/bin/suricata
cd /lib64/
cp -d /home/suricata-5.0.3/libhtp/htp/.libs/libhtp.so* ./
二、測試
1、執行：/usr/bin/suricata -c /etc/suricata/suricata.yaml -i ens33
ens33爲虛擬機網卡
2、訪問百度：curl www.baidu.com
3、查看日誌：
查看日誌和規則配置/etc/suricata/suricata.yaml：
default-log-dir: /var/log/suricata/
default-rule-path: /var/lib/suricata/rules
/var/log/suricata/fast.log
修改/etc/suricata/suricata.yaml打印http日誌：
enabled: yes
extended: yes
查看http日誌：/var/log/suricata/http.log