<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<div class="moz-cite-prefix">Here's what I did for Ubuntu 12.04:<br>
<br>
<i>apt-get install libjansson-dev libgeoip-dev</i><br>
<br>
If you're starting from a clean server, there are probably other
missing dependencies. Those are just two I noticed during my
install. Libjansson is needed for the EVE output.<br>
<br>
<i>wget </i><i><a class="moz-txt-link-freetext" href="http://www.openinfosecfoundation.org/download/suricata-2.0.tar.gz">http://www.openinfosecfoundation.org/download/suricata-2.0.tar.gz</a></i><i><br>
</i><i>tar -vxzf suricata-2.0.tar.gz</i><i><br>
</i><i>cd suricata-2.0</i><i><br>
</i><i>./configure --prefix=/opt/suricata --localstatedir=/var
--enable-geoip</i><i><br>
</i><i>make</i><i><br>
</i><i>make install</i><i><br>
</i><i><i>LD_LIBRARY_PATH=/opt/suricata/lib
/opt/suricata/bin/suricata -c
/opt/suricata/etc/suricata/suricata.yaml --af-packet=eth1 -v<br>
<br>
</i></i>Suricata should be running at this point.<br>
<br>
<i><i><i>apt-get install openjdk-7-jdk openjdk-7-jre-headless
apache2</i><i><br>
</i><br>
</i></i>Again you may find other missing dependencies for ELK on
your own machines.<br>
<i><i><br>
</i></i><i>wget
<a class="moz-txt-link-freetext" href="https://download.elasticsearch.org/elasticsearch/elasticsearch/elasticsearch-1.1.0.deb">https://download.elasticsearch.org/elasticsearch/elasticsearch/elasticsearch-1.1.0.deb</a></i><i><br>
</i><i>wget
<a class="moz-txt-link-freetext" href="https://download.elasticsearch.org/logstash/logstash/packages/debian/logstash_1.4.0-1-c82dc09_all.deb">https://download.elasticsearch.org/logstash/logstash/packages/debian/logstash_1.4.0-1-c82dc09_all.deb</a></i><i><br>
</i><i>wget
<a class="moz-txt-link-freetext" href="https://download.elasticsearch.org/kibana/kibana/kibana-3.0.0.tar.gz">https://download.elasticsearch.org/kibana/kibana/kibana-3.0.0.tar.gz</a></i><i><br>
</i><i><br>
</i><i>dpkg -i elasticsearch-1.1.0.deb</i><i><br>
</i><i>dpkg -i logstash_1.4.0-1-c82dc09_all.deb</i><i><br>
</i><i>tar -C /var/www/ -vxzf kibana-3.0.0.tar.gz</i><i><br>
</i><i><br>
</i><i>/etc/init.d/elasticsearch start</i><br>
<br>
In case you're wondering, the elasticsearch data is stored in
/var/lib/elasticsearch by default. This is my first time using
it, so that was one of the questions I had.<br>
<br>
For logstash, I followed the instructions at
<a class="moz-txt-link-freetext" href="https://redmine.openinfosecfoundation.org/projects/suricata/wiki/_Logstash_Kibana_and_Suricata_JSON_output">https://redmine.openinfosecfoundation.org/projects/suricata/wiki/_Logstash_Kibana_and_Suricata_JSON_output</a>.
I copied the geoip config verbatim. Note: for step 2, the
logstash conf should go in /etc/logstash/conf.d rather than
/etc/init<br>
<br>
<i>/etc/init.d/logstash start</i><br>
<br>
Note: if you're using the init script like that instead of adding
a service in /etc/init, you'll need to add "JAVA=/usr/bin/java" at
line 83 due to a bug in the script.<br>
<br>
Then just browse to <a class="moz-txt-link-freetext" href="http://your.server/kibana-3.0.0">http://your.server/kibana-3.0.0</a> and start
poking around.<br>
<br>
<pre class="moz-signature" cols="72">Matt</pre>
On 3/26/2014 11:38 AM, Victor Julien wrote:<br>
</div>
<blockquote cite="mid:5332F459.6010200@inliniac.net" type="cite">
<pre wrap="">On 03/25/2014 11:06 PM, Cooper F. Nelson wrote:
</pre>
<blockquote type="cite">
<pre wrap="">Ok, got it working. Ultimately I ended up starting over and
installing elasticsearch via a package first. Then the published
process worked.
I appreciate everyone's help! Now I just need to figure out how
to configure the dashboard.
</pre>
</blockquote>
<pre wrap="">
Feel free to try mine:
<a class="moz-txt-link-freetext" href="http://www.inliniac.net/files/Suricata-Eve-Dashboard">http://www.inliniac.net/files/Suricata-Eve-Dashboard</a>
You can load it through Kibana's 'load' button, then advanced, choose
file. I think we will include one in the suricata tarball as well.
Input welcome :)
Cheers,
Victor
</pre>
</blockquote>
<br>
</body>
</html>