Bottom Line: It is safe to delete old Suricata log archives (eve.json.*, .pcap). Suricata logs network security alerts and packet captures to /var/log/suricata.
Why Do Suricata PCAP Logs Exist?
Suricata is a high-performance Network Threat Detection engine that inspects network traffic for malicious signatures, DDoS vectors, and exploit payloads.
- Primary Purpose: Network packet inspection, EVE JSON telemetry, and PCAP raw packet recording.
- Storage Growth: High-bandwidth 1Gbps/10Gbps server interfaces generate 5 GB to 50 GB+ of log data daily.
What Happens If You Delete Suricata Logs?
- System Safety: ✅ Safe to Delete. Network IDS threat inspection remains fully operational.
- Reclaimed Storage: Reclaims 5 GB to 50 GB+ of server disk space.
How to Clean Suricata Logs
# Delete rotated EVE JSON logs and PCAP captures
sudo rm -f /var/log/suricata/eve.json.* /var/log/suricata/*.pcap.*Frequently Asked Questions (FAQ)
How do I limit Suricata log file sizes?
Configure logrotate for Suricata in /etc/logrotate.d/suricata with rotate 7 and daily parameters.
Discussion
Loading authentication...