Suricata + Redis Instead of eve.json: A Practical Approach from Suri Oculus
Introduction By default, Suricata writes events to eve.json. It is a standard and convenient mechanism, but under real load it quickly becomes a bottleneck. If you are building not just an IDS, but a traffic analysis system, the file-based model starts to limit your architecture. […]