EVE Socket Input

On Unix systems, the EveBox Server and EveBox Agent can receive Suricata EVE events directly from a Unix-domain socket. EveBox creates and listens on the socket, and Suricata connects to it. This avoids writing an intermediate eve.json file when both programs run on the same host.

Live Input Is Not Durable

A socket is a live transport, not a persistent queue. Events generated while the socket is disconnected, or while either program is overloaded, may be dropped and cannot be replayed. Use a regular EVE file or timestamped spool when events must survive an EveBox outage.

Socket input is not supported on Windows. It can be used alongside regular file inputs, and one EveBox process can listen on multiple socket paths.

EveBox Server Configuration

Configure the Server's input.sockets list and enable input processing:

input:
  enabled: true
  sockets:
    - path: /run/evebox/eve.sock
      type: unix_stream
      mode: "0660"

The Server requires input.enabled: true when its inputs are configured only in the configuration file. Omit input.paths, or set it to an empty list, for a socket-only deployment.

EveBox Agent Configuration

The Agent uses the same input.sockets format, but does not require an input.enabled setting:

input:
  sockets:
    - path: /run/evebox/eve.sock
      type: unix_stream
      mode: "0660"

The Agent's Server or Elasticsearch destination is configured normally and is independent of how the Agent receives EVE events.

Socket Settings

Setting	Required	Description
path	Yes	Filesystem path at which EveBox creates the socket. An absolute path is recommended.
type	No	unix_stream or unix_dgram. The default is unix_stream.
mode	No	Socket permissions written as a quoted octal value, such as "0660".

A plain path is shorthand for a stream socket with default permissions:

input:
  sockets:
    - /run/evebox/eve.sock

Use a different path for each Suricata producer. The same path cannot appear more than once in input.sockets.

Suricata Configuration

In Suricata's existing eve-log output, set filetype and filename to match the type and path configured in EveBox:

outputs:
  - eve-log:
      enabled: yes
      filetype: unix_stream
      filename: /run/evebox/eve.sock
      threaded: false

      # Keep the existing EVE event types configured here.

Suricata socket output does not support threaded: true. To use a datagram socket instead, set EveBox's type and Suricata's filetype to unix_dgram.

Suricata continues trying to connect when the socket is unavailable. Events produced before it connects are dropped, so start EveBox before Suricata when possible.

Permissions

EveBox creates the socket's parent directory when it can, then applies the optional mode to the socket. The socket remains owned by the user and group running EveBox. Ensure that:

• EveBox can create or write to the parent directory.
• Suricata's runtime user can traverse the parent directory and write to the socket.
• Group access remains valid after Suricata drops privileges and after either service restarts.

For example, a packaged EveBox Server normally runs as the evebox user and group. If Suricata runs as the suricata user, it can be granted access to a group-writable socket with:

sudo usermod -a -G evebox suricata
sudo systemctl restart suricata

User and group names vary between operating systems and packages. Avoid a world-writable socket where practical, because any local process able to write to it can submit events to EveBox.

Directories below /run are normally recreated at boot. When managing EveBox with systemd, arrange for /run/evebox to be created for the EveBox service, or choose another directory that the EveBox process can write.

Operation and Troubleshooting

At startup, EveBox logs the socket type and path on which it is listening. A stream input also logs when Suricata connects or disconnects. Check both programs' logs for permission, connection, malformed-event, or dropped-event warnings.

EveBox removes a stale socket node before binding and removes the socket it owns during an orderly shutdown. It refuses to replace a regular file, directory, or symbolic link found at the configured path.