Hi to the Suricata Community,
On Debian Linux, it seems that the directory /var/run/suricata (with /var/run symlinked to /run) is missing, apparently after reboot. This might not be new, as this older post may have the same root cause.
In the Suricata documentation at section 5.1.2 in Security considerations, the permissions to be set on /var/[run]/suricata are the following ones:
* `/var/[run]/suricata`:
chgrp -R suricata /var/run/suricata
chmod -R g+srw /var/run/suricata
On rpm based Linux, the directory stays there across reboots but apparently not on Debian.
So what would be the proper way to have this directory stay permanently in Debian?
Chatting with AI suggests two possibilities - via a conf file added in tmpfiles.d or making a RuntimeDirectory in systemd - but wondering please what would be the best recommended approach from Suricata users - many thanks.
Alex