Suricata

What should happen when a file is rotated by size? Say the filename is just "eve.json", would just be reset to 0 size and carry on? Or renamed and re-opened? If renamed, what sort of naming scheme?

With a date based name that has the resolution to handle this, its OK, even a good addition. But if using a date based name that has a resolution of a day, but the size is going to roll it over multiple times a day, do you just truncate? Or use a scheme for renaming?

Just some thoughts, but more things that should be deterministic and documented.

Maybe just mimic what unified2 does, so a seconds since epoch suffix, with an option for even higher resolution. I guess it would require the reader to take this into account as well, e.g. not missing events that are just before the rotation.