Jibril Docs

Appearance

Systemd Installation ​

Run Jibril as a systemd service for automatic startup, process supervision, and system logging integration.

First Steps ​

Download Jibril ​

bash
# Download the binary
sudo curl -L -o /usr/bin/jibril https://github.com/garnet-org/jibril-releases/releases/download/v2.9.1/jibril

# Make the binary executable
sudo chmod +x /usr/bin/jibril

# Verify the version (should be 2.9.1)
sudo /usr/bin/jibril --version
Daily Builds
bash
sudo curl -L -o /usr/bin/jibril https://github.com/garnet-org/jibril-releases/releases/download/v0.0/jibril

Install Service ​

bash
# Install the service
sudo /usr/bin/jibril --systemd install
This command creates some files
FileDescription
/etc/systemd/system/jibril.serviceSystemd service unit file
/etc/jibril/config.yamlMain configuration file
/etc/jibril/netpolicy.yamlNetwork policy configuration
/etc/default/jibrilEnvironment file (for token)
/etc/jibril/recipes/*.yamlDetection recipes (optional)

Configure API Token ​

bash
# Add your token to the service environment file
echo "GARNET_API_TOKEN=your-token-here" | sudo tee -a /etc/default/jibril
Secure the file
bash
# Secure the file
sudo chmod 600 /etc/default/jibril
# Set the owner to root
sudo chown root:root /etc/default/jibril

Custom Configuration (optional) ​

bash
sudo vi /etc/jibril/config.yaml

See Configuration for more details.

Enable and Start Service ​

bash
sudo systemctl enable --now jibril
sudo systemctl status jibril

Event Logging ​

Detection events are written in JSON format to /var/log/jibril.out.

bash
# View the events
sudo cat /var/log/jibril.out | jq

# Follow the events in real-time
sudo tail -f /var/log/jibril.out | jq

Systemd Service Management ​

Systemd Service Management

Check Status ​

bash
sudo systemctl status jibril
sudo systemctl is-active jibril
sudo systemctl is-enabled jibril

Control Service ​

bash
sudo systemctl start jibril
sudo systemctl stop jibril
sudo systemctl restart jibril
sudo systemctl reload jibril

Enable/Disable Auto-Start ​

bash
sudo systemctl enable jibril
sudo systemctl disable jibril

# Or using Jibril CLI
sudo jibril --systemd enable-now
sudo jibril --systemd disable-now

Viewing Logs ​

Systemd Journal ​

bash
sudo journalctl -u jibril           # All logs
sudo journalctl -u jibril -f        # Follow in real-time
sudo journalctl -u jibril -n 100    # Last 100 lines
sudo journalctl -u jibril -b        # Since boot

Service Override Examples ​

View or Edit Service Unit ​

bash
sudo systemctl cat jibril
sudo systemctl edit --full jibril
Advanced Configuration

Restart behavior:

ini
[Service]
Restart=always
RestartSec=10s

This will make the service restart automatically if it crashes.

Resource limits:

ini
[Service]
MemoryLimit=2G
CPUQuota=50%

This will set the memory limit to 2GB and the CPU quota to 50%.

Custom log location:

ini
[Service]
StandardOutput=append:/var/log/jibril-custom.log
StandardError=append:/var/log/jibril-error.log

Note: The events are written to /var/log/jibril.out by the varlog printer. If the stdout printer is also enabled, the events will be written to both files.

Next Steps ​