# "/var/lib/suricata/rules" directory or "/usr/share/suricata/rules/" directory?

**URL:** <https://forum.suricata.io/t/var-lib-suricata-rules-directory-or-usr-share-suricata-rules-directory/680>\
**Category:** Help\
**Created:** [October 6, 2020, 4:59pm UTC](https://forum.suricata.io/t/var-lib-suricata-rules-directory-or-usr-share-suricata-rules-directory/680 "2020-10-06T16:59:00Z")\
**Posts on this page:** 1\
**Showing post:** 3

<div class="post-metadata">

**Author:** ![ish](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/ish/32/8_2.png) [@ish](https://forum.suricata.io/u/ish)\
**Post date:** [October 6, 2020, 6:00pm UTC](https://forum.suricata.io/t/var-lib-suricata-rules-directory-or-usr-share-suricata-rules-directory/680/3 "2020-10-06T18:00:34Z")

</div>

Different directories for different purposes.

`/usr/share/suricata/rules` are read only rules that are provided with the Suricata package. These rules typically alert on anomalies while decoding packets and protocols. They remain static for a particular Suricata release, which is why they are placed in `/usr/share` - this is a pretty common practice under Linux (and unix-like systems).

`/var/lib/suricata` is where `suricata-update` places rules that change periodically, such as rulesets that you may download/update on a daily basis.

Suricata-Update will load all the engine provided rules from /usr/share/…, then go through and load rules from configured sources and output the full set into `/var/lib/suricata/rules/suricata.rules`, which Suricata then reads. Think of this file as the compiled set of all rules Suricata-Update knows about.

---

_[View the full topic](https://forum.suricata.io/t/var-lib-suricata-rules-directory-or-usr-share-suricata-rules-directory/680)._