Server Administration¶

After AC-Hunter is installed and receiving Zeek logs, ongoing administration is straightforward. This page covers the hunt CLI, service management, disk usage monitoring, log maintenance, and other routine tasks.

The hunt Command¶

The hunt command is the primary management tool for AC-Hunter. It is installed at /usr/local/bin/hunt and wraps Docker Compose operations with AC-Hunter-specific logic.

Run hunt help to see all available commands:

hunt help

Starting, Stopping, and Restarting Services¶

The -d flag runs containers in detached mode so your terminal is not blocked. hunt restart automatically runs detached.

If the remote-logs SFTP receiver was previously enabled, hunt up and hunt restart will restore it automatically.

Importing Zeek Logs¶

Use hunt import to load Zeek logs into a named database:

hunt import --logs /path/to/zeek/logs --database my_network

The --rebuild flag is useful when you need to reimport logs after changing configuration such as internal subnet definitions. It removes the existing database and performs a fresh import.

Viewing Service Logs¶

hunt logs                     # Show logs from all services
hunt logs api                 # Show logs from the API service only
hunt logs clickhouse --tail 50 -f   # Follow the last 50 lines of database logs

Available service names: api, clickhouse, syslog-ng, frontend, remote-logs

Standard Docker Compose log flags are supported: --tail, --since, --until, and -f (follow).

Managing the Remote Logs Receiver¶

The remote-logs service is the SFTP receiver that accepts Zeek logs from remote sensors. It runs as an optional Docker Compose profile.

hunt remote-logs up -d        # Start the SFTP receiver
hunt remote-logs status        # Check receiver status
hunt remote-logs restart       # Restart the receiver
hunt remote-logs down          # Stop the receiver

Applying Configuration Changes¶

AC-Hunter's main configuration file is /etc/AC-Hunter/config.hjson. To apply changes:

hunt load-config               # Apply the persisted config at /etc/AC-Hunter/config.hjson
hunt load-config /path/to/custom-config.hjson   # Apply a one-time config (does not persist across upgrades)

To preserve a custom configuration across upgrades, copy it to /etc/AC-Hunter/config.hjson and then run hunt load-config.

A reference copy of the default configuration is available at /etc/AC-Hunter/config.hjson.default.

Resetting a User Password¶

If a user is locked out of the web interface:

hunt reset-password --email="[email protected]"

Checking the Installed Version¶

hunt version

Monitoring Disk Usage¶

AC-Hunter stores data in Docker volumes and on the host filesystem. Over time, Zeek logs and the ClickHouse database can consume significant disk space. Regular monitoring helps avoid service disruptions.

Key Directories to Monitor¶

Checking Disk Usage¶

# Overall filesystem usage
df -h

# Size of Zeek remote logs
du -sh /opt/zeek/remotelogs/

# Size of application logs
du -sh /var/log/AC-Hunter/

# Docker volume usage
docker system df -v

Deleting Old Zeek Logs¶

Once Zeek logs have been imported into AC-Hunter, the raw log files on disk are no longer needed for analysis. You can safely remove logs older than a chosen threshold to free space:

# Delete imported Zeek logs older than 30 days
find /opt/zeek/remotelogs/ -type f -mtime +30 -delete

# Preview what would be deleted (dry run)
find /opt/zeek/remotelogs/ -type f -mtime +30 -print

Adjust the -mtime value to match your retention policy. For example, -mtime +90 targets files older than 90 days.

Removing Old Databases¶

If you no longer need an older analysis database, you can remove it to reclaim ClickHouse storage. Navigate to Settings → Database in the AC-Hunter web interface, select the database you want to remove, and delete it.

Automatic Log Cleanup¶

AC-Hunter includes a cron job that automatically cleans up old application logs:

• Schedule: Daily at 3:00 AM
• Behavior: Deletes files in /var/log/ older than 90 days
• Configuration file: /etc/AC-Hunter/logger-cron

This covers AC-Hunter's own application logs (not Zeek data logs). Zeek log retention must be managed separately as described above.

Service Architecture¶

AC-Hunter runs as a set of Docker containers managed by Docker Compose. Understanding the services helps with troubleshooting and monitoring.

To check the status of all containers:

docker compose -f /opt/AC-Hunter/docker-compose.yml ps

Threat Intelligence Feeds¶

AC-Hunter can match connections against known malicious IPs and domains using threat intelligence feeds. There are two types: online (dynamic) feeds fetched from URLs, and offline (static) feeds stored as local files.

Offline (Static) Feeds¶

Place plain-text files in the /etc/AC-Hunter/threat_intel_feeds/ directory. Each file should contain one IP address or FQDN per line:

198.51.100.23
203.0.113.50
malicious-domain.example.com

Files in this directory are read during log import and matched against connection data.

Online (Dynamic) Feeds¶

Online feeds are configured in /etc/AC-Hunter/config.hjson under the threat_intel section:

threat_intel: {
    online_feeds: ["https://feodotracker.abuse.ch/downloads/ipblocklist.txt"],
    custom_feeds_directory: "/etc/rita/threat_intel_feeds"
}

To add a feed, append its URL to the online_feeds array. Each URL must point to a plain-text list with one IP or domain per line.

After modifying config.hjson, apply the changes:

hunt load-config
hunt restart

Configuration File Reference¶

Routine Maintenance Checklist¶

Use this checklist for regular upkeep of your AC-Hunter server:

• Monitor disk usage: Check /opt/zeek/remotelogs/ and Docker volumes weekly
• Clean up old Zeek logs: Remove imported logs beyond your retention window
• Review application logs: Check hunt logs for errors or warnings
• Verify sensor connectivity: Confirm hunt remote-logs status shows the receiver is running
• Keep AC-Hunter updated: Apply upgrades when new versions are released
• Review user accounts: Audit users periodically via Settings → User Management in the web interface
• Validate backups: Ensure /etc/AC-Hunter/ configuration files are included in your backup strategy
• Check TLS certificates: Monitor certificate expiration if using custom certificates

Uninstalling AC-Hunter¶

If you need to completely remove AC-Hunter from a server, an uninstall script is included in the installation bundle:

sudo /opt/AC-Hunter/scripts/uninstall.sh

This removes Docker containers, volumes, networks, images, and the following directories:

• /etc/AC-Hunter
• /opt/AC-Hunter
• /var/log/AC-Hunter
• /var/tmp/ach_zeek_logs