Deployment & Management¶

For anything beyond a quick foreground test, run the sniffer as a managed systemd service. The RPM installs the service unit for you; this page covers starting, enabling, monitoring, and upgrading it.

Bring-Up Pattern¶

Bring a new sensor up in this order — it makes the first failure easy to spot:

Install the sniffer (see Installation).
Set identity, interface, and offline output in /etc/pqc-sniffer/config.yaml.
Validate the configuration with --validate-config.
Run once in the foreground and confirm NDJSON output.
Enable the systemd service for long-running operation.

Managing the Service¶

The RPM installs and registers pqc-sniffer.service.

# Start now, and start automatically on boot
sudo systemctl enable --now pqc-sniffer

# Status and health
systemctl status pqc-sniffer

# Follow logs
sudo journalctl -u pqc-sniffer -f

# Apply a configuration change
sudo systemctl restart pqc-sniffer

# Stop, and stop starting on boot
sudo systemctl disable --now pqc-sniffer

The service is configured to restart automatically on failure.

Applying Configuration Changes¶

Edit /etc/pqc-sniffer/config.yaml.

Validate before restarting:

sudo pqc-sniffer --config /etc/pqc-sniffer/config.yaml --validate-config

Restart to apply:
```
sudo systemctl restart pqc-sniffer
```

What the Service Runs As¶

The packaged unit runs the sniffer with only the capabilities it needs for packet capture (CAP_NET_RAW, CAP_NET_ADMIN) and a hardened systemd profile — it does not run as an unconfined root process. It reads /etc/pqc-sniffer/config.yaml and writes output and logs under /var/log/pqc-sniffer/.

Upgrading¶

Install the newer RPM; dnf upgrades in place and preserves your configuration:

sudo dnf install ./pqc-sniffer-linux-amd64-<new-version>.rpm
sudo systemctl restart pqc-sniffer

Your /etc/pqc-sniffer/config.yaml is kept across upgrades; the latest reference defaults are written to config.yaml.example for comparison.

Manual Installs¶

If you installed without the RPM, install the systemd unit yourself:

sudo cp pqc-sniffer.service /usr/lib/systemd/system/pqc-sniffer.service
sudo systemctl daemon-reload
sudo systemctl enable --now pqc-sniffer

Operational Checklist¶

Keep logging.database.enabled: false for file-only (offline) deployments.
Confirm the output and log paths under /var/log/pqc-sniffer/ are writable.
Set rotation (max_size_mb, max_files) so retention matches your disk budget — see Rotation and Retention.
Validate the configuration after every change, before restarting the service.