# How to view logs on evebox **URL:** \ **Category:** Help\ **Tags:** community\ **Created:** [January 23, 2024, 5:47am UTC](https://forum.suricata.io/t/how-to-view-logs-on-evebox/4419 "2024-01-23T05:47:45Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![Le\_Sok](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/le_sok/32/2611_2.png) [@Le\_Sok](https://forum.suricata.io/u/Le_Sok)\ **Post date:** [January 23, 2024, 5:47am UTC](https://forum.suricata.io/t/how-to-view-logs-on-evebox/4419/1 "2024-01-23T05:47:45Z")
Hello everyone, I want to view logs real time on evebox, who similar with evebox please guide me how to use it please. I want to change ip on evebox but becuase I use ssh If I user 127.0.0.1 I can’t access on my client pc. so please guide me how to use evebox. Best regards ---
**Author:** ![ish](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/ish/32/8_2.png) [@ish](https://forum.suricata.io/u/ish)\ **Post date:** [January 24, 2024, 1:50pm UTC](https://forum.suricata.io/t/how-to-view-logs-on-evebox/4419/2 "2024-01-24T13:50:51Z")
`--help` will give you a bunch of option… You want something like `evebox server --host 0.0.0.0`. ---
**Author:** ![Le\_Sok](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/le_sok/32/2611_2.png) [@Le\_Sok](https://forum.suricata.io/u/Le_Sok)\ **Post date:** [January 25, 2024, 2:22am UTC](https://forum.suricata.io/t/how-to-view-logs-on-evebox/4419/3 "2024-01-25T02:22:35Z")
host 0.0.0.0 I replace it to my it or I need to set it 0.0.0.0 sir ? Do run this command on server and open it on client pc right ? ---
**Author:** ![Le\_Sok](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/le_sok/32/2611_2.png) [@Le\_Sok](https://forum.suricata.io/u/Le_Sok)\ **Post date:** [January 25, 2024, 2:24am UTC](https://forum.suricata.io/t/how-to-view-logs-on-evebox/4419/4 "2024-01-25T02:24:23Z")
```auto 2024-01-25 09:23:08 INFO evebox::version: This is EveBox version 0.17.2 (rev: 536be8d); x86_64-unknown-linux-musl 2024-01-25 09:23:08 WARN evebox::elastic::client: Failed to get Elasticsearch version from http://localhost:9200, will try again: Reqwest(reqwest::Error { kind: Request, url: Url { scheme: "http", cannot_be_a_base: false, username: "", password: None, host: Some(Domain("localhost")), port: Some(9200), path: "//", query: None, fragment: None }, source: hyper::Error(Connect, ConnectError("tcp connect error", Os { code: 111, kind: ConnectionRefused, message: "Connection refused" })) }) ``` I got this error sir how to what is the issue sir? Sorry about my English Best regards, ---
**Author:** ![ish](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/ish/32/8_2.png) [@ish](https://forum.suricata.io/u/ish)\ **Post date:** [January 28, 2024, 6:09pm UTC](https://forum.suricata.io/t/how-to-view-logs-on-evebox/4419/5 "2024-01-28T18:09:40Z")
I’ll assume you don’t have Elasticsearch and such up and running already? EveBox was initially built to “just work” in that scenario, but it can also work without Elasticsearch. I’m going to assume you are running EveBox on the same machine as Suricata, so you could do something like: ```auto mkdir ~/.config/evebox evebox server --datastore sqlite -D ~/.config/evebox --host 0.0.0.0 /var/log/suricata/eve.json ``` This will use SQLite and consume the Suricata events from `/var/log/suricata/eve.json`. You can view the events and alerts with a browser, [http://your-server-ip-here:5636](http://your-server-ip-here:5636). Authentication, TLS can all be added, but for that, please see the EveBox docs. ---
**Author:** ![Le\_Sok](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/le_sok/32/2611_2.png) [@Le\_Sok](https://forum.suricata.io/u/Le_Sok)\ **Post date:** [January 29, 2024, 2:47am UTC](https://forum.suricata.io/t/how-to-view-logs-on-evebox/4419/6 "2024-01-29T02:47:20Z")
Problem solved. Thank u so much sir. ---
**Author:** ![Le\_Sok](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/le_sok/32/2611_2.png) [@Le\_Sok](https://forum.suricata.io/u/Le_Sok)\ **Post date:** [March 14, 2024, 4:02am UTC](https://forum.suricata.io/t/how-to-view-logs-on-evebox/4419/7 "2024-03-14T04:02:01Z")
I just create Elasticsearch but now still not work sir ```auto WARN evebox::elastic::client: Failed to get Elasticsearch version from http://192.168.32.149:9200, will try again: Reqwest(reqwest::Error { kind: Request, url: Url { scheme: "http", cannot_be_a_base: false, username: "", password: None, host: Some(Ipv4(192.168.32.149)), port: Some(9200), path: "//", query: None, fragment: None }, source: hyper::Error(IncompleteMessage) }) ``` I dont know how to configuration user and password please guide me to solve this issue sir Best regards. ---
**Author:** ![ish](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/ish/32/8_2.png) [@ish](https://forum.suricata.io/u/ish)\ **Post date:** [March 14, 2024, 4:05am UTC](https://forum.suricata.io/t/how-to-view-logs-on-evebox/4419/8 "2024-03-14T04:05:46Z")
I don’t know if this is a password error or not, are you able to to connect to Elasticsearch with curl? Something like: ```auto curl http://192.168.32.149:9200 ``` you should see something like: ```auto { "name" : "575d7a1705db", "cluster_name" : "docker-cluster", "cluster_uuid" : "NZvuQbcTREmNacnmf-BI1A", "version" : { "number" : "8.12.1", "build_flavor" : "default", "build_type" : "docker", "build_hash" : "6185ba65d27469afabc9bc951cded6c17c21e3f3", "build_date" : "2024-02-01T13:07:13.727175297Z", "build_snapshot" : false, "lucene_version" : "9.9.2", "minimum_wire_compatibility_version" : "7.17.0", "minimum_index_compatibility_version" : "7.0.0" }, "tagline" : "You Know, for Search" } ``` ---
**Author:** ![Le\_Sok](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/le_sok/32/2611_2.png) [@Le\_Sok](https://forum.suricata.io/u/Le_Sok)\ **Post date:** [March 14, 2024, 4:17am UTC](https://forum.suricata.io/t/how-to-view-logs-on-evebox/4419/9 "2024-03-14T04:17:39Z")
![image](https://canada1.discourse-cdn.com/flex030/uploads/suricata/original/2X/5/511a63a2013d44a131439a4e025d367c2709997b.png) I dont see anything I dont know elastic search work or not but when I check service it’s work normal. ---
**Author:** ![ish](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/ish/32/8_2.png) [@ish](https://forum.suricata.io/u/ish)\ **Post date:** [March 14, 2024, 4:34pm UTC](https://forum.suricata.io/t/how-to-view-logs-on-evebox/4419/10 "2024-03-14T16:34:54Z")
The `Empty reply from server` with curl means that EveBox is getting the same, perhaps TLS is enabled, so try: ```auto curl https://192.168.32.149:9200 ``` if that gets you the Elasticsearch info, update your EveBox configuration to use `https`. ---
**Author:** ![Le\_Sok](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/le_sok/32/2611_2.png) [@Le\_Sok](https://forum.suricata.io/u/Le_Sok)\ **Post date:** [March 15, 2024, 1:56am UTC](https://forum.suricata.io/t/how-to-view-logs-on-evebox/4419/11 "2024-03-15T01:56:00Z")
show infor but not similar like you sir ![image](https://canada1.discourse-cdn.com/flex030/uploads/suricata/original/2X/5/578bee32ebefdeccc0b54bec060fc02147cfa2ea.png) ---
**Author:** ![ish](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/ish/32/8_2.png) [@ish](https://forum.suricata.io/u/ish)\ **Post date:** [March 15, 2024, 10:33pm UTC](https://forum.suricata.io/t/how-to-view-logs-on-evebox/4419/12 "2024-03-15T22:33:46Z")
Looks like your Elasticsearch has TLS and authentication enabled. You’ll need a small configuration file, `evebox.yaml`: ```yaml database: type: elasticsearch elasticsearch: url: https://192.168.32.149:9200 disable-certificate-check: true username: USERNAME password: PASSWORD ``` Then start EveBox like `evebox server -c ./evebox.yaml`. You’ll have to sort out the username and password yourself, but likely the same you use to log into Kibana. ---
**Author:** ![Le\_Sok](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/le_sok/32/2611_2.png) [@Le\_Sok](https://forum.suricata.io/u/Le_Sok)\ **Post date:** [March 18, 2024, 12:46am UTC](https://forum.suricata.io/t/how-to-view-logs-on-evebox/4419/13 "2024-03-18T00:46:39Z")
Do I need to separate server 1 for Elasticsearch and 1 for Evebox (Suricata) or can I do Elasticsearch and Evebox (Suricata) in the same server ? Because now I do it in the same server My server ```auto Static hostname: Suricata Icon name: computer-vm Chassis: vm 🖴 Machine ID: 6d63b5e27ee44b188e8607b0792875a5 Boot ID: 68773ee370594abdbdd3d751d4cc9d66 Virtualization: vmware Operating System: Debian GNU/Linux 12 (bookworm) Kernel: Linux 6.1.0-18-amd64 Architecture: x86-64 Hardware Vendor: VMware, Inc. Hardware Model: VMware Virtual Platform Firmware Version: 6.00 ``` ---
**Author:** ![Le\_Sok](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/le_sok/32/2611_2.png) [@Le\_Sok](https://forum.suricata.io/u/Le_Sok)\ **Post date:** [March 18, 2024, 1:18am UTC](https://forum.suricata.io/t/how-to-view-logs-on-evebox/4419/14 "2024-03-18T01:18:23Z")
After I change configuration ![image](https://canada1.discourse-cdn.com/flex030/uploads/suricata/original/2X/d/d540e071e5f5b7759deabcc05dd20719414ff71f.png) I still get this error sir ![image](https://canada1.discourse-cdn.com/flex030/uploads/suricata/original/2X/6/6390904e9de3efe1a42e8a71f885b4de3fb1f5a0.png) And here I use curl to see I able to connect to Elasticsearch or not ![image](https://canada1.discourse-cdn.com/flex030/uploads/suricata/original/2X/c/c5c98e46eeeae1ce42e41f1963e398b45ce922b6.png) ---
**Author:** ![ish](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/ish/32/8_2.png) [@ish](https://forum.suricata.io/u/ish)\ **Post date:** [March 18, 2024, 2:00am UTC](https://forum.suricata.io/t/how-to-view-logs-on-evebox/4419/15 "2024-03-18T02:00:16Z")
In your `evebox.yaml`, try `https` for the URL. ---
**Author:** ![Le\_Sok](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/le_sok/32/2611_2.png) [@Le\_Sok](https://forum.suricata.io/u/Le_Sok)\ **Post date:** [March 18, 2024, 2:23am UTC](https://forum.suricata.io/t/how-to-view-logs-on-evebox/4419/16 "2024-03-18T02:23:57Z")
It’s work sir. Thank you so much. But I want to ask u about Url evebox. If I want to use to another sever and I ssh to evebox how can I open evebox because now evebox is ip local [https://127.0.0.1:5636/#/inbox](https://127.0.0.1:5636/#/inbox) ![image](https://canada1.discourse-cdn.com/flex030/uploads/suricata/original/2X/c/c18efe7c8148d4daf0187010328892040d61e3c1.png) how can I change 127.0.0.1:5636 to IP server sir ? example: [https://192.168.19.123:5636/#/inbox](https://192.168.19.123:5636/#/inbox) ---
**Author:** ![Le\_Sok](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/le_sok/32/2611_2.png) [@Le\_Sok](https://forum.suricata.io/u/Le_Sok)\ **Post date:** [March 18, 2024, 10:21am UTC](https://forum.suricata.io/t/how-to-view-logs-on-evebox/4419/17 "2024-03-18T10:21:40Z")
Why after the I restart my server and I got this error sir ![image](https://canada1.discourse-cdn.com/flex030/uploads/suricata/original/2X/c/c0e954a64fd7765746f9f3fa87f7120fed3071ff.png) Here is my configuration of evebox.yaml ```auto # This is a minimal evebox.yaml for Elasticsearch and SQLite. http: ## By default, EveBox binds to localhost. Uncomment this line to open ## it up. #host: "0.0.0.0" database: type: elasticsearch elasticsearch: url: https://192.168.32.149:9200 disable-certificate-check: true username: elastic password: elastic ## If using the Filebeat Suricata module, you'll probably want to ## change the index to "filebeat". index: logstash # If using the Filebeat Suricata module this needs to be true. ``` ---
**Author:** ![ish](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/ish/32/8_2.png) [@ish](https://forum.suricata.io/u/ish)\ **Post date:** [March 19, 2024, 3:03pm UTC](https://forum.suricata.io/t/how-to-view-logs-on-evebox/4419/18 "2024-03-19T15:03:26Z")
Set the host to `0.0.0.0`, there is an example in the configuration in you posted just above here. ---
**Author:** ![ish](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/ish/32/8_2.png) [@ish](https://forum.suricata.io/u/ish)\ **Post date:** [March 19, 2024, 3:03pm UTC](https://forum.suricata.io/t/how-to-view-logs-on-evebox/4419/19 "2024-03-19T15:03:45Z")
Probably another instance running. You’ll need to kill that one first. ---
**Author:** ![Le\_Sok](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/le_sok/32/2611_2.png) [@Le\_Sok](https://forum.suricata.io/u/Le_Sok)\ **Post date:** [March 20, 2024, 4:42am UTC](https://forum.suricata.io/t/how-to-view-logs-on-evebox/4419/20 "2024-03-20T04:42:59Z")
I just connect Elasticsearch with evebox already sir but I just test curl [http://testmynids.org/uid/index.html](http://testmynids.org/uid/index.html) It have logs on suricata on fast.log ![image](https://canada1.discourse-cdn.com/flex030/uploads/suricata/original/2X/6/6742bdb71d7bce4f0296fcb2205f7719bb26f88b.png) But when I check on evebox dashboard it’s doesn’t show anything al try refresh many time but it’s not work when I check on terminal evebox it’s show like this ![image](https://canada1.discourse-cdn.com/flex030/uploads/suricata/original/2X/0/0f58609b0db6f7244132887b95fb84a422c9d083.png) on web ui ![image](https://canada1.discourse-cdn.com/flex030/uploads/suricata/original/2X/9/9ceb19ebd6f235cb820e1adf43f7f7a0bc207cc6.png) Why it’s doesn’t show sir ? please help! [Next page](https://forum.suricata.io/t/how-to-view-logs-on-evebox/4419.md?page=2)