Being bold categorizing it as a bug although it’s non critical
Behavior: (how to reproduce)
On fresh install ISP (suricata) is disabled by default, you have to enable it in the server-manager or manually enable it as as documented here.
Just after a fresh install evebox is enabled by default and running, AFAIK not able to report something.
Same applies if you decide to disable IPS: evebox keeps on running.
Expected behavior:
evebox start and stops with IPS (suricata).
Notes:
I think the status of evebox can be included in
nethserver-suricata ../Module/IPS.php
Unfortunately PHP is not my strong point, hence uncomfortable produce a PR on this.
Then try to start and stop both service. If suricata is stopped, evebox should be stopped too (but it will not start again, you need BindsTo for that).
By the way, this solution will not work if you’re using a custom suricata configuration which is scanning events from a remote source.