Troubleshooting and Logs

If things are not working as expected or you are experiencing some trouble and would like to have a further look please find below SELKS's major components log locations:

Suricata

Log files and folders:

/var/log/suricata.log
/var/log/suricata/stats.log
/var/log/suricata/core/

The folder /var/log/suricata/core/ will contain any core dumps in case of a segfault. Further reading on what to do and how to report Suricata bugs.

Elasticsearch

Log files:

/var/log/elasticsearch/elasticsearch.log

Unassigned shards:

https://www.elastic.co/guide/en/elasticsearch/reference/current/cat-shards.html

Logstash

Log files:

/var/log/logstash/logstash.log