4. Upgrading¶
4.1. General instructions¶
Suricata can be upgraded by simply installing the new version to the same
locations as the already installed version. When installing from source,
this means passing the same --prefix
, --sysconfdir
,
--localstatedir
and --datadir
options to configure
.
$ suricata --build-info|grep -A 3 '\-\-prefix'
--prefix /usr
--sysconfdir /etc
--localstatedir /var
--datarootdir /usr/share
4.1.1. Configuration Updates¶
New versions of Suricata will occationally include updated config files:
classification.config
and reference.config
. Since the Suricata
installation will not overwrite these if they exist, they should be manually
updated. If there are no local modifications they can simply be overwritten
by the ones Suricata supplies.
Major updates include new features, new default settings and often also remove features.
4.2. Upgrading 4.1 to 5.0¶
4.2.1. Major changes¶
- New protocols enabled by default: snmp (new config only)
- New protocols disabled by default: rdp, sip
- New defaults for protocols: nfs, smb, tftp, krb5 ntp are all enabled by default (new config only)
- VXLAN decoder enabled by default. To disable, set
decoder.vxlan.enabled
tofalse
. - HTTP LZMA support enabled by default. To disable, set
lzma-enabled
tofalse
in each of thelibhtp
configurations in use. - classification.config updated. ET 5.0 ruleset will use this.
- decoder event counters use ‘decoder.event’ as prefix now. This can
be controlled using the
stats.decoder-events-prefix
setting.
4.2.2. Removals¶
dns-log
, the text dns log. Use EVE.dns instead.file-log
, the non-EVE JSON file log. Use EVE.files instead.