Suricata

The bug seems not related to the http logging. As we have multiple threads, we decode more than one packet in parallel and assign a flow pointer to each packet, which is same for one session. When the packet comes to logging module, in the mean time the stream & app layer thread has already parsed the app layer request. As the packet has the same flow pointer assigned to it, the initial SYN or SYN/ACK packets also pass the app layer checks in the logging part and this causes the different time stamps to get printed.

I was thinking that it would be good to have a thread api, which allows us to pause/unpause a thread module e.g. Loghttp. The benefit of it will be that, we can pause the loghttp module until we have received a new request from the client. Upon receiving new request we unpause it and the request will be logged. After logging we can pause it again. Thus it will hopefully avoid the above inconsistency and improve performance to by avoiding unnecessary call to loghttp module.

After a 24 hr http.log has been inspected - this seems to be no longer an issue.