{% extends "siem/base.html" %} {% block sub-title %}Daemon Documentation | {% endblock %} {% block content-main %}

Daemon Documentation

Parser and sentry daemons can be started, restarted, and stopped with scripts/logesp, which includes options for setting the LogESP base directory and virtual environment base directory.

Usage: logesp [-hv] {start|stop|restart|status|clean} [-lps] [-b LOGESPBASE] [-e ENVBASE]

Optional arguments:
  -h                      Print this help message
  -v                      Print the version number
  -l                      Clean old events using local EOL date
  -p                      Run parser only (no sentry)
  -s                      Run sentry only (no parser)
  -b LOGESPBASE           Set the LogESP base directory
  -e ENVBASE              Set a virtual environment

Daemons can be started manually, or by /etc/rc.local. Parser configuration is located in config/parser.conf inside the repository. Cleaning can be done manually, or by cron.

{% endblock %}