-
Notifications
You must be signed in to change notification settings - Fork 1.4k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Filestore alertlog 4881 v6 #9254
Conversation
When filestore keyword is triggered, the file is not yet stored, when the alert is generated, but only marked for storing. Ticket: 4881
Information: QA ran without warnings. Pipeline 15325 |
@@ -166,8 +166,12 @@ static void OutputFilestoreFinalizeFiles(ThreadVars *tv, const OutputFilestoreLo | |||
ff->file_store_id) == (int)sizeof(js_metadata_filename)) { | |||
WARN_ONCE(WOT_SNPRINTF, "Failed to write file info record. Output filename truncated."); | |||
} else { | |||
// Set temporarily flag that file is stored for logging. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
can we get rid of this hack?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Looks like unneeded thanks to `OUTPUT_FILEDATA_FLAG_CLOSE guarding the call on OutputFilestoreFinalizeFiles
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
would like to see a cleaner implementation
Replaced by #9266 |
Link to redmine ticket:
https://redmine.openinfosecfoundation.org/issues/4881
Describe changes:
storing
in alert when it is planned to be stored...OISF/suricata-verify#1146
Rebase #9146 after Suricata7 release