[Oisf-users] Question on multiple instances of Suricata

[John Peters]

Not sure how you feel about containerization, but one of the benefits is
you can specify a volume (directory or partition) to mount to, and then map
it to Suricata's config directory. Basically, while Suricata is running
inside the container it's expecting to look at /etc/suricata/... for
configs, but you can map it to point to another directory outside the
container (on the actual host) which could point to a separate directory
for each instance/interface. Plus you get a good way to make sure it has
enough resources by telling it to load an instance of Suricata with x
cores, y RAM, etc.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openinfosecfoundation.org/pipermail/oisf-users/attachments/20190516/0fac3242/attachment.html>