etc/suricata
var/log/suricata