# Suricata eve.JSON in Security Onion

**URL:** <https://forum.suricata.io/t/suricata-eve-json-in-security-onion/1368>\
**Category:** Help\
**Tags:** ips, community\
**Created:** [May 13, 2021, 8:41am UTC](https://forum.suricata.io/t/suricata-eve-json-in-security-onion/1368 "2021-05-13T08:41:39Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![garrygosafe](https://avatars.discourse-cdn.com/v4/letter/g/91b2a8/32.png) [@garrygosafe](https://forum.suricata.io/u/garrygosafe)\
**Post date:** [May 13, 2021, 8:41am UTC](https://forum.suricata.io/t/suricata-eve-json-in-security-onion/1368/1 "2021-05-13T08:41:39Z")

</div>

Hello,

I have setup Suricata with Security Onion and I have enabled the eve.JSON ouput in the .yaml file. However, I cannot find the file on the system.

Is there something else I need to do or would it be stored in a different directory to /var/log/nsm?

Many Thanks

---

<div class="post-metadata">

**Author:** ![arcot](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/arcot/32/2296_2.png) [@arcot](https://forum.suricata.io/u/arcot)\
**Post date:** [May 14, 2021, 12:02pm UTC](https://forum.suricata.io/t/suricata-eve-json-in-security-onion/1368/2 "2021-05-14T12:02:43Z")

</div>

Hi,  
I believe it should be stored under default-log-dir (specified in suricata.yaml). Otherwise you can specified logs location with -l if running suricata via command.

[https://suricata.readthedocs.io/en/suricata-6.0.2/command-line-options.html](https://suricata.readthedocs.io/en/suricata-6.0.2/command-line-options.html)

---

<div class="post-metadata">

**Author:** ![garrygosafe](https://avatars.discourse-cdn.com/v4/letter/g/91b2a8/32.png) [@garrygosafe](https://forum.suricata.io/u/garrygosafe)\
**Post date:** [May 14, 2021, 12:15pm UTC](https://forum.suricata.io/t/suricata-eve-json-in-security-onion/1368/3 "2021-05-14T12:15:01Z")

</div>

Hello,

It is states as /var/log/suricata but this directory doesn’t seem to exist. Should I specify a different directory?

Also do I need the fast.log enabled for this to generate the eve.JSON?

Many Thanks!

Andrew

---

<div class="post-metadata">

**Author:** ![Jeff\_Lucovsky](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/jeff_lucovsky/32/11_2.png) [@Jeff\_Lucovsky](https://forum.suricata.io/u/Jeff_Lucovsky)\
**Post date:** [May 14, 2021, 1:21pm UTC](https://forum.suricata.io/t/suricata-eve-json-in-security-onion/1368/4 "2021-05-14T13:21:24Z")

</div>

You do not need to have `fast.log` enabled for eve.json content.

---

<div class="post-metadata">

**Author:** ![garrygosafe](https://avatars.discourse-cdn.com/v4/letter/g/91b2a8/32.png) [@garrygosafe](https://forum.suricata.io/u/garrygosafe)\
**Post date:** [May 14, 2021, 4:37pm UTC](https://forum.suricata.io/t/suricata-eve-json-in-security-onion/1368/5 "2021-05-14T16:37:37Z")

</div>

Hello,

Really appreciate the response, I will get looking in the yaml file. I setup Suricata on Ubuntu and the eve.JSON was created but with Security Onion it didn’t seem to be.

Thanks again!