NAME
fever-run - start FEVER service
SYNOPSIS
fever run [flags]
DESCRIPTION
The 'run' command starts the FEVER service, consuming events from the input and executing all processing components.
OPTIONS
--active-rdns[=false]
enable active rDNS enrichment for src/dst IPs
--active-rdns-cache-expiry=2m0s
cache expiry interval for rDNS lookups
--active-rdns-private-only[=false]
only do active rDNS enrichment for RFC1918 IPs
--bloom-alert-prefix="BLF"
String prefix for Bloom filter alerts
--bloom-blacklist-iocs=[/,/index.htm,/index.html]
Blacklisted strings in Bloom filter (will cause filter to be rejected)
-b, --bloom-file=""
Bloom filter for external indicator screening
-z, --bloom-zipped[=false]
use gzipped Bloom filter file
-c, --chunksize=50000
chunk size for batched event handling (e.g. inserts)
--context-cache-timeout=1h0m0s
time for flow metadata to be kept for uncompleted flows
--context-enable[=false]
collect and forward flow context for alerted flows
--context-submission-exchange="context"
Exchange to which flow context events will be submitted
--context-submission-url="amqp://guest:guest@localhost:5672/"
URL to which flow context will be submitted
-d, --db-database="events"
database DB
--db-enable[=false]
write events to database
-s, --db-host="localhost:5432"
database host
--db-maxtablesize=500
Maximum allowed cumulative table size in GB
-m, --db-mongo[=false]
use MongoDB
-p, --db-password="sensor"
database password
--db-rotate=1h0m0s
time interval for database table rotations
-u, --db-user="sensor"
database user
--dummy[=false]
log locally instead of sending home
--flowextract-bloom-selector=""
IP address Bloom filter to select flows to extract
--flowextract-enable[=false]
extract and forward flow metadata
--flowextract-submission-exchange="flows"
Exchange to which raw flow events will be submitted
--flowextract-submission-url="amqp://guest:guest@localhost:5672/"
URL to which raw flow events will be submitted
-n, --flowreport-interval=0s
time interval for report submissions
--flowreport-nocompress[=false]
send uncompressed flow reports (default is gzip)
--flowreport-submission-exchange="aggregations"
Exchange to which flow reports will be submitted
--flowreport-submission-url="amqp://guest:guest@localhost:5672/"
URL to which flow reports will be submitted
--flushcount=100000
maximum number of events in one batch (e.g. for flow extraction)
-f, --flushtime=1m0s
time interval for event aggregation
-T, --fwd-all-types[=false]
forward all event types
-t, --fwd-event-types=[alert,stats]
event types to forward to socket
--heartbeat-enable[=false]
Forward HTTP heartbeat event
--heartbeat-times=[]
Times of day to send heartbeat (list of 24h HH:MM strings)
-h, --help[=false]
help for run
--in-buffer-drop[=true]
drop incoming events on FEVER side instead of blocking the input socket
--in-buffer-length=500000
input buffer length (counted in EVE objects)
-r, --in-redis=""
Redis input server (assumes "suricata" list key, no pwd)
--in-redis-nopipe[=false]
do not use Redis pipelining
-i, --in-socket="/tmp/suri.sock"
filename of input socket (accepts EVE JSON)
--ip-alert-prefix="IP-BLACKLIST"
String prefix for IP blacklist alerts
--ip-blacklist=""
List with IP ranges to alert on
--logfile=""
Path to log file
--logjson[=false]
Output logs in JSON format
--metrics-enable[=false]
submit performance metrics to central sink
--metrics-submission-exchange="metrics"
Exchange to which metrics will be submitted
--metrics-submission-url="amqp://guest:guest@localhost:5672/"
URL to which metrics will be submitted
-o, --out-socket="/tmp/suri-forward.sock"
path to output socket (to forwarder), empty string disables forwarding
--pdns-enable[=false]
collect and forward aggregated passive DNS data
--pdns-submission-exchange="pdns"
Exchange to which passive DNS events will be submitted
--pdns-submission-url="amqp://guest:guest@localhost:5672/"
URL to which passive DNS events will be submitted
--profile=""
enable runtime profiling to given file
--reconnect-retries=0
number of retries connecting to socket or sink, 0 = no retry limit
--toolname="fever"
set toolname
-v, --verbose[=false]
enable verbose logging (debug log level)
OPTIONS INHERITED FROM PARENT COMMANDS
--config=""
config file (default is $HOME/.fever.yaml)
--mgmt-host=""
hostname:port definition for management server
--mgmt-network="tcp"
network (tcp/udp) definition for management server
--mgmt-socket="/tmp/fever-mgmt.sock"
Socket path for management server