# How to know pcap file analysis is done & transfer log via socket API?

**URL:** <https://forum.suricata.io/t/how-to-know-pcap-file-analysis-is-done-transfer-log-via-socket-api/216>\
**Category:** Help\
**Created:** [May 11, 2020, 1:06am UTC](https://forum.suricata.io/t/how-to-know-pcap-file-analysis-is-done-transfer-log-via-socket-api/216 "2020-05-11T01:06:12Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Jimliu](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/jimliu/32/111_2.png) [@Jimliu](https://forum.suricata.io/u/Jimliu)\
**Post date:** [May 11, 2020, 1:06am UTC](https://forum.suricata.io/t/how-to-know-pcap-file-analysis-is-done-transfer-log-via-socket-api/216/1 "2020-05-11T01:06:12Z")

</div>

Hi, I write a wrap program in Python to analyze pcap file in offline mode using command line, suricata -r test.pcap, and use Python to analyze the output logs.

1. How to know offline analysis is done and notify Python which can parse logs? (Suricata is invoked in cmdline)
2. Is there a way for Suricata to transmit logs via socket API to another machine? In .yaml, there are a few options such as local socket, local file and Redis.

Many thanks.

---

<div class="post-metadata">

**Author:** ![syoc](https://avatars.discourse-cdn.com/v4/letter/s/f475e1/32.png) [@syoc](https://forum.suricata.io/u/syoc)\
**Post date:** [May 11, 2020, 7:19am UTC](https://forum.suricata.io/t/how-to-know-pcap-file-analysis-is-done-transfer-log-via-socket-api/216/2 "2020-05-11T07:19:23Z")

</div>

Have a look at [https://suricata.readthedocs.io/en/latest/manpages/suricatasc.html#pcap-mode-commands](https://suricata.readthedocs.io/en/latest/manpages/suricatasc.html#pcap-mode-commands) for working with Suricata in pcap mode.  
suricatasc is a python program so you can import the libraries it uses in your own application.  
Logging to file and then moving the files sounds easier than dealing with sockets.

---

<div class="post-metadata">

**Author:** ![ish](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/ish/32/8_2.png) [@ish](https://forum.suricata.io/u/ish)\
**Post date:** [May 11, 2020, 7:21pm UTC](https://forum.suricata.io/t/how-to-know-pcap-file-analysis-is-done-transfer-log-via-socket-api/216/3 "2020-05-11T19:21:46Z")

</div>

> [@Jimliu](#):
>
> Is there a way for Suricata to transmit logs via socket API to another machine? In .yaml, there are a few options such as local socket, local file and Redis.

Not built-in or provided as that is often specific to an implementation. You could log to syslog and have your syslog forward to a remote machine. Or if you are integrating with Elastic, you could look at Logstash and Filebeat. Or as it sounds like you are processing offline pcaps, perhaps scp is enough?

---

<div class="post-metadata">

**Author:** ![Andreas\_Herz](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/andreas_herz/32/52_2.png) [@Andreas\_Herz](https://forum.suricata.io/u/Andreas_Herz)\
**Post date:** [May 12, 2020, 8:20pm UTC](https://forum.suricata.io/t/how-to-know-pcap-file-analysis-is-done-transfer-log-via-socket-api/216/4 "2020-05-12T20:20:36Z")

</div>

> [@Jimliu](#):
>
> How to know offline analysis is done and notify Python which can parse logs? (Suricata is invoked in cmdline)

If it’s just run once with each pcap, you can just wait for the process to end. That’s how I do it in a small script.