FEVER-RUN(1)

💖 FEVER-RUN — the run girlies' era 💖

okay so this is fever-run from the FEVER manual (section 1, bestie, the classics ✨). it's the page that tells you how to start the FEVER service. strap in. 🎀

---

🌸 NAME 🌸

fever-run — start FEVER service

like. that's the whole vibe. it starts the service. slay.

---

🦋 SYNOPSIS 🦋

fever run [flags]

that's it. that's the incantation. fever run and then whatever flags your heart desires 💅

---

✨ DESCRIPTION ✨

the run command starts the FEVER service. and when I say starts, I mean it's literally doing the most: it's consuming events from the input and executing all the processing components. every single one. no cap. it's giving main character energy, it's giving workhorse, it's giving "I don't take breaks." 🫶

---

👑 OPTIONS 👑

okay this is the long one. hydration check, bestie, we're going through ALL of them, and yes I mean all 48. nobody gets left behind. 💖

• --active-rdns[=false] — turn on active rDNS enrichment for src/dst IPs 🦋
• --active-rdns-cache-expiry=2m0s — how long rDNS lookups get to chill in the cache before expiry
• --active-rdns-private-only[=false] — only do active rDNS enrichment for RFC1918 IPs (the private ones, iykyk)
• --bloom-alert-prefix="BLF" — the string prefix used for Bloom filter alerts ✨
• --bloom-blacklist-iocs=[/,/index.htm,/index.html] — blacklisted strings in the Bloom filter. ⚠️ heads up: these will cause the filter to be rejected, so don't just throw stuff in there
• -b, --bloom-file="" — the Bloom filter for external indicator screening
• -z, --bloom-zipped[=false] — use a gzipped Bloom filter file 🎀
• -c, --chunksize=50000 — chunk size for batched event handling (think inserts)
• --context-cache-timeout=1h0m0s — how long flow metadata sticks around for uncompleted flows
• --context-enable[=false] — collect and forward flow context for alerted flows
• --context-submission-exchange="context" — the exchange that flow context events get submitted to
• --context-submission-url="amqp://guest:guest@localhost:5672/" — the URL flow context gets submitted to
• -d, --db-database="events" — database DB 🗄️
• --db-enable[=false] — write events to the database
• -s, --db-host="localhost:5432" — database host
• --db-maxtablesize=500 — maximum allowed cumulative table size, in GB
• -m, --db-mongo[=false] — use MongoDB 💜
• -p, --db-password="sensor" — database password 🔐
• --db-rotate=1h0m0s — time interval for database table rotations
• -u, --db-user="sensor" — database user
• --dummy[=false] — log locally instead of sending home 🏠
• --flowextract-bloom-selector="" — IP address Bloom filter used to select which flows to extract
• --flowextract-enable[=false] — extract and forward flow metadata
• --flowextract-submission-exchange="flows" — the exchange raw flow events get submitted to
• --flowextract-submission-url="amqp://guest:guest@localhost:5672/" — the URL raw flow events get submitted to
• -n, --flowreport-interval=0s — time interval for report submissions
• --flowreport-nocompress[=false] — send uncompressed flow reports (default is gzip, fyi)
• --flowreport-submission-exchange="aggregations" — the exchange flow reports get submitted to
• --flowreport-submission-url="amqp://guest:guest@localhost:5672/" — the URL flow reports get submitted to
• --flushcount=100000 — maximum number of events in one batch (for flow extraction, for example)
• -f, --flushtime=1m0s — time interval for event aggregation ⏰
• -T, --fwd-all-types[=false] — forward ALL event types, no filter, no discrimination 🔥
• -t, --fwd-event-types=[alert,stats] — which event types get forwarded to the socket
• --heartbeat-enable[=false] — forward the HTTP heartbeat event 💓
• --heartbeat-times=[] — times of day to send the heartbeat (a list of 24h HH:MM strings)
• -h, --help[=false] — help for run 🫶
• --in-buffer-drop[=true] — drop incoming events on the FEVER side instead of blocking the input socket
• --in-buffer-length=500000 — input buffer length, counted in EVE objects
• -r, --in-redis="" — Redis input server (it assumes the "suricata" list key, no pwd)
• --in-redis-nopipe[=false] — do not use Redis pipelining
• -i, --in-socket="/tmp/suri.sock" — filename of the input socket (accepts EVE JSON) 🐍
• --ip-alert-prefix="IP-BLACKLIST" — string prefix for IP blacklist alerts
• --ip-blacklist="" — list of IP ranges to alert on
• --logfile="" — path to the log file
• --logjson[=false] — output logs in JSON format
• --metrics-enable[=false] — submit performance metrics to the central sink 📊
• --metrics-submission-exchange="metrics" — the exchange metrics get submitted to
• --metrics-submission-url="amqp://guest:guest@localhost:5672/" — the URL metrics get submitted to
• -o, --out-socket="/tmp/suri-forward.sock" — path to the output socket (to the forwarder). empty string disables forwarding entirely
• --pdns-enable[=false] — collect and forward aggregated passive DNS data
• --pdns-submission-exchange="pdns" — the exchange passive DNS events get submitted to
• --pdns-submission-url="amqp://guest:guest@localhost:5672/" — the URL passive DNS events get submitted to
• --profile="" — enable runtime profiling to the given file
• --reconnect-retries=0 — number of retries when connecting to a socket or sink. 0 = no retry limit, go off king 👑
• --toolname="fever" — set the toolname
• -v, --verbose[=false] — enable verbose logging (debug log level) 🔍

---

🧚 OPTIONS INHERITED FROM PARENT COMMANDS 🧚

the family heirlooms, bestie. these come from the parent 💜

• --config="" — config file (default is $HOME/.fever.yaml)
• --mgmt-host="" — hostname:port definition for the management server
• --mgmt-network="tcp" — network (tcp/udp) definition for the management server
• --mgmt-socket="/tmp/fever-mgmt.sock" — socket path for the management server

---

🌈 SEE ALSO 🌈

• fever(1)

the origin story. go read it. 💖

---

and that's the whole page, bestie!! ✨ this was FEVER, version vibes from Sep 2025, section 1 — FEVER-RUN(1). now go start that service, you absolute icon. periodt. 💅🦋