Where does Suricata store its log files on Linux?

Q: Where does Suricata store its log files on Linux?

Suricata logs to /var/log/suricata/suricata.log on Linux. 3 other Linux log locations are recorded below.

Suricata

4 log locations · Linux

Open Information Security Foundation · Vendor documentation (opens in a new tab)

Where Suricata keeps its logs

Suricata logs to /var/log/suricata/suricata.log on Linux. 3 other Linux log locations are recorded below.

Paths are printed exactly as Suricata writes them. Environment variables like %LOCALAPPDATA% and $XDG_STATE_HOME are never expanded, so a path can be pasted straight into a shell. Where a path differs between installer types or shipping flavours, each one is racked as its own card below - why that happens.

LNX

Suricata - Linux

Open Information Security Foundation

Engine log/var/log/suricata/suricata.log

Alerts and events (JSON)/var/log/suricata/eve.json

Alerts/var/log/suricata/fast.log

Statistics/var/log/suricata/stats.log

Wrong path? Add a variant