CentOS7.5下编译suricata-5.0.3及简单使用

一、安装

参考官方文档：https://redmine.openinfosecfoundation.org/projects/suricata/wiki/CentOS_Installation
1、安装依赖库：yum -y install gcc libpcap-devel pcre-devel libyaml-devel file-devel
zlib-devel jansson-devel nss-devel libcap-ng-devel libnet-devel tar make
libnetfilter_queue-devel lua-devel PyYAML libmaxminddb-devel rustc cargo
lz4-devel
2、rustc cargo需要依赖：epel
yum install epel-release -y
yum install rustc cargo
3、下载源码后解压->编译->安装
（1）wget http://www.openinfosecfoundation.org/download/suricata-5.0.3.tar.gz
（2）tar -xvzf suricata-5.0.3.tar.gz
（3）cd suricata-5.0.3
（4）./configure --prefix=/usr --sysconfdir=/etc --localstatedir=/var --enable-nfqueue --enable-lua
（5）make
（6）make install-full
4、拷贝依赖库libhtp到 /lib64/目录下：ldd /usr/bin/suricata

cd /lib64/
cp -d /home/suricata-5.0.3/libhtp/htp/.libs/libhtp.so* ./

二、测试

1、执行：/usr/bin/suricata -c /etc/suricata/suricata.yaml -i ens33
ens33为虚拟机网卡

2、访问百度：curl www.baidu.com

3、查看日志：
查看日志和规则配置/etc/suricata/suricata.yaml：
default-log-dir: /var/log/suricata/

default-rule-path: /var/lib/suricata/rules

/var/log/suricata/fast.log

修改/etc/suricata/suricata.yaml打印http日志：
enabled: yes
extended: yes
查看http日志：/var/log/suricata/http.log