How To Install Suricata on AlmaLinux 8

Install Suricata on AlmaLinux 8

In this tutorial, we will show you how to install Suricata on AlmaLinux 8. For those of you who didn’t know, Suricata is a free and open-source, mature, fast, and robust network threat detection engine. It can function as intrusion detection (IDS) engine, inline intrusion prevention system (IPS), network security monitoring (NSM) as well as an offline pcap processing tool. Suricata inspects the network traffic using powerful and extensive rules and signature language and has powerful Lua scripting support for the detection of complex threats.

This article assumes you have at least basic knowledge of Linux, know how to use the shell, and most importantly, you host your site on your own VPS. The installation is quite simple and assumes you are running in the root account, if not you may need to add ‘sudo‘ to the commands to get root privileges. I will show you the step-by-step installation of the Suricata on an AlmaLinux 8. You can follow the same instructions for Rocky Linux.


  • A server running one of the following operating systems: AlmaLinux 8, CentOS, and Rocky Linux 8.
  • It’s recommended that you use a fresh OS install to prevent any potential issues.
  • SSH access to the server (or just open Terminal if you’re on a desktop).
  • A non-root sudo user or access to the root user. We recommend acting as a non-root sudo user, however, as you can harm your system if you’re not careful when acting as the root.

Install Suricata on AlmaLinux 8

Step 1. First, let’s start by ensuring your system is up-to-date.

sudo dnf update
sudo dnf install epel-release
sudo dnf config-manager --set-enabled PowerTools
sudo dnf install diffutils gcc jansson-devel make nss-devel pcre-devel python3 python3-pyyaml rust-toolset zlib-devel curl wget tar lua lz4-devel

Step 2. Installing Suricata on AlmaLinux 8.

Now we download the latest stable release of Suricata source code from the official page:

tar xzf suricata-6.0.3.tar.gz

Then, compile and install Suricata using the following command below:

cd suricata-6.0.3
./configure --sysconfdir=/etc --localstatedir=/var --prefix=/usr/ --enable-lua --enable-geopip 
make install-full

Verify Suricata installation:

suricata -V

Step 3. Configure Suricata.

Once installed, The configuration file is located at /etc/suricata/suricata.yaml. However, for our basic setup, we will only focus on the network interface on which Suricata is listening and the IP address attached to that interface:

nano /etc/suricata/suricata.yaml

Add the following lines:

  # more specific is better for alert accuracy and performance
    #HOME_NET: "[,,]"
    HOME_NET: "[]"
    #HOME_NET: "[]"
    #HOME_NET: "[]"
    #HOME_NET: "[]"
    #HOME_NET: "any"

    #EXTERNAL_NET: "any"

Next, set the interface name at af-packet:

# Linux high speed capture support
  - interface: enp0s3

Define the Suricata rules files to use. We are using the default ET rules in this demo:

default-rule-path: /var/lib/suricata/rules

  - suricata.rules

After that, disable Suricata packet offloading by disabling the interface Large Receive Offload (LRO)/Generic Receive Offload (GRO):

sudo ethtool -K <interface> gro off lro off


tx-checksum-ip-generic: on
generic-segmentation-offload: on
generic-receive-offload: off
large-receive-offload: off [fixed]

If enabled, disable it by running the command below:

ethtool -K <interface> gro off lro off

Step 4. Running Suricata.

Suricata can be managed by a systemd service. But before initializing it, first, specify the interface on which Suricata is listening as below:

nano /etc/sysconfig/suricata

Add the following lines:

# Add options to be passed to the daemon
#OPTIONS="-i eth0 --user suricata "
OPTIONS="-i enp0s3 --user suricata "

Save and exit the file also, start and enable Suricata to run on boot:

sudo systemctl enable --now suricata

To check if Suricata is running check the Suricata log:

sudo tail /var/log/suricata/suricata.log

Step 5. Testing Suricata Rules.

In this demo, we are using the default ET Suricata rules. If you have created your own custom rules, be sure to test the Suricata rules for syntax errors:

sudo suricata -c /etc/suricata/suricata.yaml -T -v


26/7/2021 -- 16:46:11 - - Running suricata under test mode
26/7/2021 -- 16:46:11 - - This is Suricata version 5.0.3 RELEASE running in SYSTEM mode
26/7/2021 -- 16:46:11 - - CPUs/cores online: 1
26/7/2021 -- 16:46:11 - - fast output device (regular) initialized: fast.log
26/7/2021 -- 16:46:11 - - eve-log output device (regular) initialized: eve.json
26/7/2021 -- 16:46:11 - - stats output device (regular) initialized: stats.log
26/7/2021 -- 16:46:13 - - 1 rule files processed. 20676 rules successfully loaded, 0 rules failed
26/7/2021 -- 16:46:13 - - Threshold config parsed: 0 rule(s) found
26/7/2021 -- 16:46:13 - - 20679 signatures processed. 1138 are IP-only rules, 3987 are inspecting packet payload, 15324 inspect application layer, 103 are decoder event only
26/7/2021 -- 16:46:28 - - Configuration provided was successfully loaded. Exiting.
26/7/2021 -- 16:46:28 - - cleaning up signature grouping structure… complete

Congratulations! You have successfully installed Suricata. Thanks for using this tutorial for installing Suricata on your AlmaLinux 8 system. For additional help or useful information, we recommend you check the official Suricata website.

VPS Manage Service Offer
If you don’t have time to do all of this stuff, or if this is not your area of expertise, we offer a service to do “VPS Manage Service Offer”, starting from $10 (Paypal payment). Please contact us to get the best deal!


r00t is a seasoned Linux system administrator with a wealth of experience in the field. Known for his contributions to, r00t has authored numerous tutorials and guides, helping users navigate the complexities of Linux systems. His expertise spans across various Linux distributions, including Ubuntu, CentOS, and Debian. r00t's work is characterized by his ability to simplify complex concepts, making Linux more accessible to users of all skill levels. His dedication to the Linux community and his commitment to sharing knowledge makes him a respected figure in the field.
Back to top button