Run in daemon mode¶

When you deploy Suricata on a service instance, you can start Suricata automatically on system boot up and run in a daemon mode.

To run Suricata in the daemon mode:

1. Disable console output and set it to a file in the suricata.yaml configuration file:

   outputs:
   - console:
        enabled: no
   - file:
        enabled: yes
        filename: /var/log/suricata.log
   

2. Make Suricata start on system boot up:

   • Create the initialization script /etc/init/suricata.conf:

     # suricata
     description "IDPS Daemon"
     start on runlevel [2345]
     stop on runlevel [!2345]
     expect fork
     exec suricata -D --pidfile /var/run/suricata.pid -c
     /etc/suricata/suricata.yaml -i eth0
     

   or

   • Specify the --pidfile option in suricata.yaml.