# logging dirs are empty

 user  ~  malware  909052404576dd98c968ebfcf73a99f6  tmp  ls
merged.pcap  suricata.yaml
 user  ~  malware  909052404576dd98c968ebfcf73a99f6  tmp  ls /tmp/*.log /tmp/*.json
ls: cannot access '/tmp/*.log': No such file or directory
ls: cannot access '/tmp/*.json': No such file or directory


# log dir settings in yaml:

 user  ~  malware  909052404576dd98c968ebfcf73a99f6  tmp  grep default-log-dir ./suricata.yaml
default-log-dir: /tmp/


# run suricata (note version in output):

 user  ~  malware  909052404576dd98c968ebfcf73a99f6  tmp  sudo /opt/suricata-git.latest/src/suricata -c ./suricata.yaml -S /home/user/rules/suricata4.local.rules -r ./merged.pcap -k none
[15696] 30/7/2019 -- 11:27:17 - (suricata.c:1071) <Notice> (LogVersion) -- This is Suricata version 5.0.0-dev (rev 3d5eccf08) running in USER mode
[15696] 30/7/2019 -- 11:27:17 - (tm-threads.c:2145) <Notice> (TmThreadWaitOnThreadInit) -- all 9 packet processing threads, 4 management threads initialized, engine started.
[15696] 30/7/2019 -- 11:27:17 - (suricata.c:2851) <Notice> (SuricataMainLoop) -- Signal Received.  Stopping engine.
[15710] 30/7/2019 -- 11:27:17 - (source-pcap-file.c:378) <Notice> (ReceivePcapFileThreadExitStats) -- Pcap-file module read 1 files, 571 packets, 237391 bytes


# logs land in local dir not /tmp/

 user  ~  malware  909052404576dd98c968ebfcf73a99f6  tmp  ls
eve.json  flowbits.json     merged.pcap       prefilter_perf.log   rule_perf.log  suricata.log
fast.log  keyword_perf.log  packet_stats.log  rule_group_perf.log  stats.log      suricata.yaml
 user  ~  malware  909052404576dd98c968ebfcf73a99f6  tmp  ls /tmp/*.log /tmp/*.json
ls: cannot access '/tmp/*.log': No such file or directory
ls: cannot access '/tmp/*.json': No such file or directory