suricata安装，配置，运行

1.suricata安装
./configure
./make
./make install-full

2.配置
/usr/local/etc/suricata/suricata.yaml
配置syslog输出为yes

3.运行
suricata -c suricata.yuml -s ./rules -i ens0

配置系统日志输出：
/etc/rsyslog.d/rsyslog.conf

启动rsyslog失败
(个人重启时遇到问题，配置文件第36行注释掉后重启成功)
删除/var/lib/rsyslog下的imjournal.state

#./configure --with-mysql
barnyard2安装时找不到libmysqlclient
#./configure --with-mysql --with-mysql-libraries=/usr/lib64/msyql

错误：barnyard2 failed to execute query:
mysql -uroot -ppasswd -Dsnort < /barnyard2-master/schemas/create_mysql;