NAME
suricata_stat_check - LibreNMS JSON SNMP extend and Nagios style check for Suricata stats.
SYNOPSIS
suricata_stats_check [-m single] [-s <eve>] [-S <instance name>] [-d <drop percent warn>] [-D <drop percent crit>] [-e <error delta warn>] [-E <error delta crit>] [-r <error percent warn>] [-r <error percent crit>] [-a <seconds>]
suricata_stats_check -m slug [--slug <slug>] [-l <log dir>] [-d <drop percent warn>] [-D <drop percent crit>] [-e <error delta warn>] [-E <error delta crit>] [-r <error percent warn>] [-r <error percent crit>] [-a <seconds>]
suricata_stats_check -m manual -1 <manual> [-d <drop percent warn>] [-D <drop percent crit>] [-e <error delta warn>] [-E <error delta crit>] [-r <error percent warn>] [-r <error percent crit>] [-2 <manual>] [-3 <manual>] [-4 <manual>] [-5 <manual>] [-6 <manual>] [-7 <manual>] [-8 <manual>] [-9 <manual>] [-0 <manual>] [-a <seconds>]
suricata_stats_check -c [-b]
DESCRIPTION
For Nagious, this should be ran via NRPE.
For LibreNMS, this should be set up to run from cron and as a snmp extend.
cron...
*/5 * * * * /usr/local/bin/suricata_stat_check
snmp.conf...
extend suricata-stats /usr/local/bin/suricata_stat_check -c -b
FLAGS
-a <seconds>
How far back to read in seconds.
-c
Print the saved cached and exit.
This should be considered depreciated.
The following is more efficient for SNMP.
extend suricata-stats /bin/cat /var/cache/suricata-monitoring/snmp-b
Use the encoded SNMP return for -c.
-m <mode>
Mode to run in.
Default: single
-s <eve>
Eve file for use with single mode.
Default: /var/log/suricata/eve.json
-S <instance name>
Instance name to use in single mode.
Default: ids
--slug <slug>
The slug to use in slug mode.
Default: alert
-l <log dir>
Log directory for slug mode.
Default: /var/log/suricata
-0 <manual>
A file to use in manual mode.
-1 <manual>
A file to use in manual mode.
-2 <manual>
A file to use in manual mode.
-3 <manual>
A file to use in manual mode.
-4 <manual>
A file to use in manual mode.
-5 <manual>
A file to use in manual mode.
-6 <manual>
A file to use in manual mode.
-7 <manual>
A file to use in manual mode.
-8 <manual>
A file to use in manual mode.
-9 <manual>
A file to use in manual mode.
-0 <manual>
A file to use in manual mode.
-d <drop percent warn>
Percent of drop packets to warn on.
Default: 0.75%
-D <drop percent crit>
Percent of dropped packets to critical on.
Default: 1%
-e <error delta warn>
Error delta to warn on.
This is in errors/second. So 1 would be 1 error a second.
Default: 1
-E <error delta crit>
Error delta to critical on.
This is in errors/second. So 2 would be 2 error a second.
Default: 2
-n
Run as a nagios check style instead of LibreNMS.
-h
Print help info.
--help
Print help info.
-v
Print version info.
--version
Print version info.
MODES
single
Use the specified eve file, -e, and the specified instance name, -i.
slug
Check the dir specified, -l. for files starting with the slug, -s. The files must match /^$slug\-[A-Za-z\_\-]\.[Jj][Ss][Oo][Nn]$/. The instance name is formed by removing /^$slug\-/ and /\.[Jj][Ss][Oo][Nn]$/. So "alert-ids.json" becomes "ids".
manual
Use the files specified via -0 to -9 to specify instance names and files. The value taken by each of those is comma seperated with the first part being the instance name and the second being the eve file. So "inet,/var/log/suricata/inet.json" would be a instance name of "inet" with a eve file of "/var/log/suricata/inet.json".