Services are controlled by the use of Security Onion scripts (so-<noun>-<verb>) which act as wrappers to other lower-level scripts. You can see a list of all of these scripts with the following command:

ls /usr/sbin/so-*

These scripts are detailed below.

All services

You can control all services with the so-<verb> scripts as follows.

Check status of all services:

sudo so-status

Start all services:

sudo so-start

Stop all services:

sudo so-stop

Restart all services:

sudo so-restart

The three main categories of services are server, sensor, and elastic.

Server services

Check status of sguild (Sguil server):

sudo so-sguild-status

Start sguild:

sudo so-sguild-start

Stop sguild:

sudo so-sguild-stop

Restart sguild:

sudo so-sguild-restart

Sensor services

Sensor services are controlled with so-sensor-*.

The following examples are for Zeek, but you could substitute whatever sensor service you’re trying to control (nids, pcap, etc.).

Check status of Zeek:

sudo so-zeek-status

Start Zeek:

sudo so-zeek-start

Stop Zeek:

sudo so-zeek-stop

Restart Zeek:

sudo so-zeek-restart

Elastic services

Elastic services are controlled with so-elastic-*.

Check status of the Elastic stack:

sudo so-elastic-status

Start the Elastic stack:

sudo so-elastic-start

Stop the Elastic stack:

sudo so-elastic-stop

Restart the Elastic stack:

sudo so-elastic-restart