How to monitor Suricata is done analyzing a pcap file?

[xifeng (Xifeng Liu)]

Hello guys, How can I determine if Suricata has done analyzing a pcap file when I’m using the suricatasc ? Thank you in advance!

[Jeff_Lucovsky]

Hi,

Have you seen 24.2. Suricata Socket Control — Suricata 8.0.0-dev documentation and the previous forum posts that have asked about the same/similar issue?

How to know pcap file analysis is done & transfer log via socket API?

Hi, I write a wrap program in Python to analyze pcap file in offline mode using command line, suricata -r test.pcap, and use Python to analyze the output logs. How to know offline analysis is done and notify Python which can parse logs? (Suricata is invoked in cmdline) Is there a way for Suricata to transmit logs via socket API to another machine? In .yaml, there are a few options such as local socket, local file and Redis. Many thanks.

If that doesn’t help, please give more information about

• Suricata version – we recommend using the latest released Suricata version 6.0.12
• Command line used to start Suricata
• Commands used with suricatasc