Suricata

When Suricata is restarted the PCAP file count resets, which results in old PCAP files not being removed/rolled.

in log-pcap.c::PcapLogDataInit() the file count is always initialized to 1:
pl->file_cnt = 1;

It would be nice if the file count maintained state between runs so that 'max-files:' would not be exceeded.

Perhaps this could be achieved by determining how many PCAP files exist in the directory when Suricata starts up and initialize the count to that number, or perhaps at least a configurable option to remove old PCAP files when PCAP initializes.