Looking for logs on IDS/IPS

Bill_Ny · June 4, 2025, 11:31pm

I cant find anything about logs. Documented. Lots of questions.
Thought maybe SNMP would give me some more info on whats going on.
– this is what my suricata log file looks like.----
@Route10:/a/suricata/log# tail -f suricata.log

[21389 - Suricata-Main] 2025-06-03 03:31:36 Info: threshold-config: Threshold config parsed: 0 rule(s) found

[21389 - Suricata-Main] 2025-06-03 03:31:36 Info: detect: 43802 signatures processed. 1227 are IP-only rules, 4361 are inspecting packet payload, 37996 inspect application layer, 108 are decoder event only

[21389 - Suricata-Main] 2025-06-03 03:33:26 Notice: detect: rule reload complete

[21659 - FR#01] 2025-06-03 21:03:26 Warning: logopenfile: Write error on Unix socket “/var/run/ips.sock”: Connection refused; reconnecting…

[21659 - FR#01] 2025-06-03 21:03:26 Notice: logopenfile: Reconnected socket “/var/run/ips.sock”

[21389 - Suricata-Main] 2025-06-04 03:31:22 Notice: detect: rule reload starting

[21389 - Suricata-Main] 2025-06-04 03:31:39 Info: detect: 1 rule files processed. 43831 rules successfully loaded, 0 rules failed, 0

[21389 - Suricata-Main] 2025-06-04 03:31:39 Info: threshold-config: Threshold config parsed: 0 rule(s) found

[21389 - Suricata-Main] 2025-06-04 03:31:39 Info: detect: 43834 signatures processed. 1232 are IP-only rules, 4361 are inspecting packet payload, 38023 inspect application layer, 108 are decoder event only

[21389 - Suricata-Main] 2025-06-04 03:33:37 Notice: detect: rule reload complete @Route10:/a/suricata/log# tail -f suricata.log