Can I start evebox in the background somehow...and upon system startup?

[domiflichi]

I was wondering if there is a way to start Evebox hidden/in the background, and automatically upon system startup (Ubuntu 22.04).
Currently, I am manually opening a terminal, entering the evebox server command, and just leaving that Terminal open. At the very least it would be cool to start evebox in the background somehow so that I don't have to keep the terminal open.
I'm guessing there's a way to do this (not specific to Evebox necessarily), but not knowing much about Linux, I'm a bit lost.

[jasonish]

EveBox has no way to do this by itself, instead it relies on systemd, which can be a bit distribution specific. The easiest way is to install the Debian packages I have, which should work just fine on Ubuntu, see: https://evebox.org/downloads/

You can then edit /etc/defaults/evebox and add your command line options, something like:

EVEBOX_OPTS="-D /var/lib/evebox --datastore sqlite --input /var/log/suricata/eve.json"

Then..

systemctl enable --now evebox

Then it will start on boot..

Note that it runs as user evebox when you do it this way, so you'll want to make sure that the evebox can read /var/log/suricata/eve.json, and have write access to /var/lib/evebox (which should happen by default when installed with the package) or wherever you decide to place that directory.

You can of course roll your own systemd unit file as well.

[domiflichi]

Thank you so much @jasonish ! Some of that is a bit over my head, but I think I can figure it out. Keep up the awesome work!