{"id":162,"date":"2026-10-27T02:55:23","date_gmt":"2026-10-27T02:55:23","guid":{"rendered":"https:\/\/idstower.com\/blog\/?p=162"},"modified":"2026-10-27T02:55:23","modified_gmt":"2026-10-27T02:55:23","slug":"building-a-custom-suricata-rpm-package","status":"publish","type":"post","link":"https:\/\/idstower.com\/blog\/building-a-custom-suricata-rpm-package\/","title":{"rendered":"Building a Custom Suricata RPM Package"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">OISF builds Suricata for Rocky Linux, AlmaLinux and RHEL in its <a href=\"https:\/\/copr.fedorainfracloud.org\/coprs\/g\/oisf\/suricata-8.0\/\">Copr repository<\/a>, and that package already has most of the high-speed capture features: eBPF, XDP and DPDK support. Two things are left out: AF_XDP capture, and the eBPF programs themselves, which the build compiles but doesn&#8217;t package. You may also need a feature that only a custom build can have, such as Napatech or PF_RING capture.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Rather than compiling Suricata from scratch, you can rebuild OISF&#8217;s own source RPM with a few changes. The result keeps everything the official package has, from its systemd service and <code>suricata<\/code> user to its log rotation and configuration handling, and RPM works out the libraries it depends on by itself.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">In this post we&#8217;ll rebuild the official Suricata 8 package for Rocky Linux 9 and 10, with AF_XDP support and the eBPF programs included. For Debian and Ubuntu, see <a href=\"https:\/\/idstower.com\/blog\/building-a-custom-suricata-deb-package\/\">Building a Custom Suricata DEB Package<\/a>.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">The build setup<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">We used:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Rocky Linux 9 and Rocky Linux 10, x86_64<\/li>\n\n\n\n<li>Suricata 8.0.7, from OISF&#8217;s <code>@oisf\/suricata-8.0<\/code> Copr repository<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Two things to know before you start:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Build on the same release as your sensors.<\/strong> A package built on Rocky 9 is for EL9 hosts, and one built on Rocky 10 for EL10 hosts. AlmaLinux uses the same commands. RHEL and Oracle Linux name the CRB and EPEL repositories differently, so enable those two as <a href=\"https:\/\/docs.fedoraproject.org\/en-US\/epel\/getting-started\/\">EPEL&#8217;s guide<\/a> explains.<\/li>\n\n\n\n<li><strong>Build as a normal user, on a build machine.<\/strong> <code>rpmbuild<\/code> works in your home directory and installs nothing, but its build dependencies come to about 130 packages, so use a VM or a container rather than a sensor. Don&#8217;t build as root.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Rebuilding the Suricata RPM<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">An RPM package is built from a source RPM: the program&#8217;s source code plus a spec file, the recipe that configures, compiles and packages it. We&#8217;ll take OISF&#8217;s source RPM, change four lines of its spec, and build it.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Preparing the build machine<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Install the RPM build tools, and enable the repositories the build needs: CRB (CodeReady Builder) and EPEL for libraries such as <code>libxdp-devel<\/code> and <code>hyperscan-devel<\/code>, and OISF&#8217;s Copr for Suricata&#8217;s source RPM. <code>rpmdev-setuptree<\/code> then creates the <code>~\/rpmbuild<\/code> directories:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo dnf install -y dnf-plugins-core epel-release rpm-build rpmdevtools\nsudo dnf config-manager --set-enabled crb\nsudo dnf copr enable -y @oisf\/suricata-8.0\nrpmdev-setuptree<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">Getting the source RPM<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Download the source RPM and unpack it into <code>~\/rpmbuild<\/code>, which puts Suricata&#8217;s source code in <code>SOURCES<\/code> and the spec, <code>suricata.spec<\/code>, in <code>SPECS<\/code>:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>dnf download --source suricata\nrpm -i suricata-8.0.7-*.src.rpm\ncd ~\/rpmbuild\/SPECS<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><code>rpm<\/code> prints a few warnings, which are expected: <code>NOKEY<\/code>, because dnf imports the Copr&#8217;s signing key only when it installs a package from it, and that the <code>mockbuild<\/code> user or <code>mock<\/code> group doesn&#8217;t exist, which belong to the system OISF builds its packages on.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Changing the spec<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Keep a copy of the original, make the four changes, and compare:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>cp suricata.spec suricata.spec.orig\nsed -i 's\/^Release: .*\/&amp;.custom1\/' suricata.spec\nsed -i 's\/^BuildRequires: clang llvm libbpf-devel$\/&amp; libxdp-devel\/' suricata.spec\nsed -i '\/^%check\/i mkdir -p %{buildroot}%{_libexecdir}\/suricata\/ebpf\\ninstall -m 644 ebpf\/*.bpf %{buildroot}%{_libexecdir}\/suricata\/ebpf\/\\n' suricata.spec\nsed -i 's|^%{_datadir}\/%{name}\/rules$|&amp;\\n%{_libexecdir}\/suricata\/|' suricata.spec\ndiff -u suricata.spec.orig suricata.spec<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">What each change does:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>The release<\/strong> gets <code>.custom1<\/code>, so your package reads <code>8.0.7-1.el9.custom1<\/code>. You can tell it apart from OISF&#8217;s, and dnf ranks it above OISF&#8217;s <code>8.0.7-1.el9<\/code>.<\/li>\n\n\n\n<li><strong><code>libxdp-devel<\/code><\/strong> is added to the build dependencies: Suricata turns AF_XDP on when it finds libxdp.<\/li>\n\n\n\n<li><strong>Two <code>install<\/code> lines<\/strong> copy the eBPF programs to <code>\/usr\/libexec\/suricata\/ebpf\/<\/code>, where <a href=\"https:\/\/docs.suricata.io\/en\/latest\/capture-hardware\/ebpf-xdp.html\">Suricata&#8217;s eBPF guide<\/a> puts them. The spec already compiles them (<code>--enable-ebpf-build<\/code>), but Suricata&#8217;s <code>make install<\/code> has no rule for them.<\/li>\n\n\n\n<li><strong>The file list<\/strong> gets that directory, so the programs go into the package.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">The diff should show exactly these changes:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>-Release: 1%{?dist}\n+Release: 1%{?dist}.custom1\n...\n-BuildRequires: clang llvm libbpf-devel\n+BuildRequires: clang llvm libbpf-devel libxdp-devel\n...\n+mkdir -p %{buildroot}%{_libexecdir}\/suricata\/ebpf\n+install -m 644 ebpf\/*.bpf %{buildroot}%{_libexecdir}\/suricata\/ebpf\/\n...\n+%{_libexecdir}\/suricata\/<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">Building the package<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Install the build dependencies the spec lists, then build:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo dnf builddep -y suricata.spec\nrpmbuild -ba suricata.spec<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><code>rpmbuild<\/code> configures and compiles Suricata, runs its tests and writes the packages, in about ten minutes on a 16-core machine. Along the way, configure&#8217;s summary should show AF_XDP, eBPF and XDP support enabled:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Suricata Configuration:\n  AF_PACKET support:                       yes\n  AF_XDP support:                          yes\n  DPDK support:                            yes\n  eBPF support:                            yes\n  XDP support:                             yes<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">The build ends by listing the packages it wrote. Yours is <code>~\/rpmbuild\/RPMS\/x86_64\/suricata-8.0.7-1.el9.custom1.x86_64.rpm<\/code> (<code>el10<\/code> on Rocky 10). The <code>suricata-debuginfo<\/code> and <code>suricata-debugsource<\/code> packages next to it are only for debugging crashes. RPM works out the package&#8217;s dependencies from the libraries Suricata links against, so <code>libxdp<\/code> is now one of them without you listing it.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Installing and checking the package<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Copy the package to a sensor running the same release. Suricata needs two libraries from EPEL, hiredis and Hyperscan (Vectorscan on EL10), so enable EPEL there, then install the package:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo dnf install -y epel-release\nsudo dnf install -y .\/suricata-8.0.7-*.custom1.x86_64.rpm<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Then check that AF_XDP, eBPF and XDP support are enabled, and that the eBPF programs are installed:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>$ suricata --build-info\nThis is Suricata version 8.0.7 RELEASE\n...\nSuricata Configuration:\n  AF_PACKET support:                       yes\n  AF_XDP support:                          yes\n  DPDK support:                            yes\n  eBPF support:                            yes\n  XDP support:                             yes\n...\n$ ls \/usr\/libexec\/suricata\/ebpf\/\nbypass_filter.bpf  filter.bpf  lb.bpf  vlan_filter.bpf  xdp_filter.bpf  xdp_lb.bpf<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">To use an eBPF program, point the <code>af-packet<\/code> section of <code>suricata.yaml<\/code> at it, for example <code>ebpf-lb-file: \/usr\/libexec\/suricata\/ebpf\/lb.bpf<\/code> with <code>cluster-type: cluster_ebpf<\/code>. <a href=\"https:\/\/docs.suricata.io\/en\/latest\/capture-hardware\/ebpf-xdp.html\">Suricata&#8217;s eBPF and XDP guide<\/a> covers each program.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">AF_XDP is a capture method of its own, next to AF_PACKET: start Suricata with <code>--af-xdp=&lt;interface><\/code>, or set it up in the <code>af-xdp<\/code> section of <code>suricata.yaml<\/code>, as <a href=\"https:\/\/docs.suricata.io\/en\/latest\/capture-hardware\/af-xdp.html\">Suricata&#8217;s AF_XDP guide<\/a> explains. Suricata starts one AF_XDP capture thread per receive queue that the network card reports, up to the number of CPU cores, so it needs a card whose driver reports its queues. A container&#8217;s virtual interface reports none: Suricata logs <code>af-xdp: 0 queues, so using 0 threads<\/code> and captures nothing.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Keeping your build<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">If a sensor also has OISF&#8217;s Copr enabled, dnf will treat OISF&#8217;s next release, such as 8.0.8, as an upgrade of yours, and replace your build with one without AF_XDP. To keep yours, exclude Suricata from that repository:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo dnf config-manager --save --setopt='copr:copr.fedorainfracloud.org:group_oisf:suricata-8.0.excludepkgs=suricata'<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">When a new Suricata version comes out, rebuild it the same way from OISF&#8217;s new source RPM.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Building with other features<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The same steps add other features that the official package leaves out, such as Napatech and PF_RING support: add the option to the <code>%configure<\/code> line of <code>suricata.spec<\/code> (<code>--enable-napatech<\/code> or <code>--enable-pfring<\/code>), and install the vendor&#8217;s driver and development files on the build machine first. Your sensors will need the vendor&#8217;s driver as well.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">How IDSTower can help<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/idstower.com\/\">IDSTower<\/a> deploys your package to every host of a cluster with its <a href=\"https:\/\/idstower.com\/docs\/advance\/custom_built_packages_repo.html\">User-Custom Packages Repository<\/a>:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Copy the package and its dependencies once.<\/strong> Put them on the IDSTower server, in a folder named after the Suricata version and the hosts&#8217; OS release and architecture: <code>\/opt\/idstower\/custom\/Suricata\/packages\/8.0.7\/Rocky9\/x86_64\/<\/code> (<code>Rocky10<\/code> for Rocky 10). Copy only <code>suricata-8.0.7-1.el9.custom1.x86_64.rpm<\/code>: the folder must hold just one file whose name starts with <code>suricata<\/code>, so leave the debuginfo and debugsource packages out. Version 8.0.7 then shows up in the cluster setup wizard.<\/li>\n\n\n\n<li><strong>IDSTower installs them on every host<\/strong>, including hosts without internet access, and checks that each host reports the version you picked. It then runs Suricata under its own configuration and services, alongside health monitoring and rule life-cycle management, from one web interface.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">To collect the dependency packages, run this on a host set up like your sensors, with the same release, EPEL enabled and no Suricata, then copy the files from <code>suricata-deps\/<\/code> into the folder, next to your package:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo dnf install -y --downloadonly --downloaddir=suricata-deps .\/suricata-8.0.7-*.custom1.x86_64.rpm<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Try it in the <a href=\"https:\/\/demo.idstower.com\/\">live demo<\/a> (no signup), or <a href=\"https:\/\/idstower.com\/getLicense.php?type=Standard\">get a free license<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>OISF builds Suricata for Rocky Linux, AlmaLinux and RHEL in its Copr repository, and that package already has most of the high-speed capture features: eBPF, XDP and DPDK support. Two things are left out: AF_XDP capture, and the eBPF programs themselves, which the build compiles but doesn&#8217;t package. You may also need a feature that [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","ast-disable-related-posts":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"footnotes":""},"categories":[3],"tags":[8],"class_list":["post-162","post","type-post","status-publish","format-standard","hentry","category-suricata-ids","tag-suricata"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.8 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Building a Custom Suricata RPM Package - IDSTower Blog<\/title>\n<meta name=\"description\" content=\"Rebuild the official Suricata 8 RPM for Rocky, Alma and RHEL 9 or 10 with AF_XDP and its eBPF programs, then deploy it across your IDS cluster.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/idstower.com\/blog\/building-a-custom-suricata-rpm-package\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Building a Custom Suricata RPM Package - IDSTower Blog\" \/>\n<meta property=\"og:description\" content=\"Rebuild the official Suricata 8 RPM for Rocky, Alma and RHEL 9 or 10 with AF_XDP and its eBPF programs, then deploy it across your IDS cluster.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/idstower.com\/blog\/building-a-custom-suricata-rpm-package\/\" \/>\n<meta property=\"og:site_name\" content=\"IDSTower Blog\" \/>\n<meta property=\"article:published_time\" content=\"2026-10-27T02:55:23+00:00\" \/>\n<meta name=\"author\" content=\"admin\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@IDSTower\" \/>\n<meta name=\"twitter:site\" content=\"@IDSTower\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"admin\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"7 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/idstower.com\\\/blog\\\/building-a-custom-suricata-rpm-package\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/idstower.com\\\/blog\\\/building-a-custom-suricata-rpm-package\\\/\"},\"author\":{\"name\":\"admin\",\"@id\":\"https:\\\/\\\/idstower.com\\\/blog\\\/#\\\/schema\\\/person\\\/de3006b0e8ec6f07ed283b57edc0137d\"},\"headline\":\"Building a Custom Suricata RPM Package\",\"datePublished\":\"2026-10-27T02:55:23+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/idstower.com\\\/blog\\\/building-a-custom-suricata-rpm-package\\\/\"},\"wordCount\":1058,\"publisher\":{\"@id\":\"https:\\\/\\\/idstower.com\\\/blog\\\/#organization\"},\"keywords\":[\"Suricata\"],\"articleSection\":[\"Suricata IDS\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/idstower.com\\\/blog\\\/building-a-custom-suricata-rpm-package\\\/\",\"url\":\"https:\\\/\\\/idstower.com\\\/blog\\\/building-a-custom-suricata-rpm-package\\\/\",\"name\":\"Building a Custom Suricata RPM Package - IDSTower Blog\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/idstower.com\\\/blog\\\/#website\"},\"datePublished\":\"2026-10-27T02:55:23+00:00\",\"description\":\"Rebuild the official Suricata 8 RPM for Rocky, Alma and RHEL 9 or 10 with AF_XDP and its eBPF programs, then deploy it across your IDS cluster.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/idstower.com\\\/blog\\\/building-a-custom-suricata-rpm-package\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/idstower.com\\\/blog\\\/building-a-custom-suricata-rpm-package\\\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/idstower.com\\\/blog\\\/building-a-custom-suricata-rpm-package\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/idstower.com\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Building a Custom Suricata RPM Package\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/idstower.com\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/idstower.com\\\/blog\\\/\",\"name\":\"IDSTower Blog\",\"description\":\"Suricata tutorials and guides\",\"publisher\":{\"@id\":\"https:\\\/\\\/idstower.com\\\/blog\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/idstower.com\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/idstower.com\\\/blog\\\/#organization\",\"name\":\"IDSTower\",\"url\":\"https:\\\/\\\/idstower.com\\\/blog\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/idstower.com\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/idstower.com\\\/blog\\\/wp-content\\\/uploads\\\/2021\\\/07\\\/logo-min-1.png\",\"contentUrl\":\"https:\\\/\\\/idstower.com\\\/blog\\\/wp-content\\\/uploads\\\/2021\\\/07\\\/logo-min-1.png\",\"width\":184,\"height\":50,\"caption\":\"IDSTower\"},\"image\":{\"@id\":\"https:\\\/\\\/idstower.com\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/x.com\\\/IDSTower\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/idstower.com\\\/blog\\\/#\\\/schema\\\/person\\\/de3006b0e8ec6f07ed283b57edc0137d\",\"name\":\"admin\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/446d57f9f6515801789387627928696577a5920591f0aa3658734e8e5f482304?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/446d57f9f6515801789387627928696577a5920591f0aa3658734e8e5f482304?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/446d57f9f6515801789387627928696577a5920591f0aa3658734e8e5f482304?s=96&d=mm&r=g\",\"caption\":\"admin\"},\"sameAs\":[\"http:\\\/\\\/idstower.com\\\/blog\"]}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Building a Custom Suricata RPM Package - IDSTower Blog","description":"Rebuild the official Suricata 8 RPM for Rocky, Alma and RHEL 9 or 10 with AF_XDP and its eBPF programs, then deploy it across your IDS cluster.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/idstower.com\/blog\/building-a-custom-suricata-rpm-package\/","og_locale":"en_US","og_type":"article","og_title":"Building a Custom Suricata RPM Package - IDSTower Blog","og_description":"Rebuild the official Suricata 8 RPM for Rocky, Alma and RHEL 9 or 10 with AF_XDP and its eBPF programs, then deploy it across your IDS cluster.","og_url":"https:\/\/idstower.com\/blog\/building-a-custom-suricata-rpm-package\/","og_site_name":"IDSTower Blog","article_published_time":"2026-10-27T02:55:23+00:00","author":"admin","twitter_card":"summary_large_image","twitter_creator":"@IDSTower","twitter_site":"@IDSTower","twitter_misc":{"Written by":"admin","Est. reading time":"7 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/idstower.com\/blog\/building-a-custom-suricata-rpm-package\/#article","isPartOf":{"@id":"https:\/\/idstower.com\/blog\/building-a-custom-suricata-rpm-package\/"},"author":{"name":"admin","@id":"https:\/\/idstower.com\/blog\/#\/schema\/person\/de3006b0e8ec6f07ed283b57edc0137d"},"headline":"Building a Custom Suricata RPM Package","datePublished":"2026-10-27T02:55:23+00:00","mainEntityOfPage":{"@id":"https:\/\/idstower.com\/blog\/building-a-custom-suricata-rpm-package\/"},"wordCount":1058,"publisher":{"@id":"https:\/\/idstower.com\/blog\/#organization"},"keywords":["Suricata"],"articleSection":["Suricata IDS"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/idstower.com\/blog\/building-a-custom-suricata-rpm-package\/","url":"https:\/\/idstower.com\/blog\/building-a-custom-suricata-rpm-package\/","name":"Building a Custom Suricata RPM Package - IDSTower Blog","isPartOf":{"@id":"https:\/\/idstower.com\/blog\/#website"},"datePublished":"2026-10-27T02:55:23+00:00","description":"Rebuild the official Suricata 8 RPM for Rocky, Alma and RHEL 9 or 10 with AF_XDP and its eBPF programs, then deploy it across your IDS cluster.","breadcrumb":{"@id":"https:\/\/idstower.com\/blog\/building-a-custom-suricata-rpm-package\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/idstower.com\/blog\/building-a-custom-suricata-rpm-package\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/idstower.com\/blog\/building-a-custom-suricata-rpm-package\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/idstower.com\/blog\/"},{"@type":"ListItem","position":2,"name":"Building a Custom Suricata RPM Package"}]},{"@type":"WebSite","@id":"https:\/\/idstower.com\/blog\/#website","url":"https:\/\/idstower.com\/blog\/","name":"IDSTower Blog","description":"Suricata tutorials and guides","publisher":{"@id":"https:\/\/idstower.com\/blog\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/idstower.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/idstower.com\/blog\/#organization","name":"IDSTower","url":"https:\/\/idstower.com\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/idstower.com\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/idstower.com\/blog\/wp-content\/uploads\/2021\/07\/logo-min-1.png","contentUrl":"https:\/\/idstower.com\/blog\/wp-content\/uploads\/2021\/07\/logo-min-1.png","width":184,"height":50,"caption":"IDSTower"},"image":{"@id":"https:\/\/idstower.com\/blog\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/IDSTower"]},{"@type":"Person","@id":"https:\/\/idstower.com\/blog\/#\/schema\/person\/de3006b0e8ec6f07ed283b57edc0137d","name":"admin","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/446d57f9f6515801789387627928696577a5920591f0aa3658734e8e5f482304?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/446d57f9f6515801789387627928696577a5920591f0aa3658734e8e5f482304?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/446d57f9f6515801789387627928696577a5920591f0aa3658734e8e5f482304?s=96&d=mm&r=g","caption":"admin"},"sameAs":["http:\/\/idstower.com\/blog"]}]}},"_links":{"self":[{"href":"https:\/\/idstower.com\/blog\/wp-json\/wp\/v2\/posts\/162","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/idstower.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/idstower.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/idstower.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/idstower.com\/blog\/wp-json\/wp\/v2\/comments?post=162"}],"version-history":[{"count":1,"href":"https:\/\/idstower.com\/blog\/wp-json\/wp\/v2\/posts\/162\/revisions"}],"predecessor-version":[{"id":163,"href":"https:\/\/idstower.com\/blog\/wp-json\/wp\/v2\/posts\/162\/revisions\/163"}],"wp:attachment":[{"href":"https:\/\/idstower.com\/blog\/wp-json\/wp\/v2\/media?parent=162"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/idstower.com\/blog\/wp-json\/wp\/v2\/categories?post=162"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/idstower.com\/blog\/wp-json\/wp\/v2\/tags?post=162"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}