no documentation for file-store-waldo
suricata.yaml.in includes a "waldo" line, but that seems to be ignored unless there is a "file-store-waldo: yes" line elsewhere in suricata.yaml. As far as I can tell, there is no documentation at all for file-store-waldo. It would be good both to include it in suricata.yaml.in as well as to mention in the existing waldo line that it needs to be enabled elsewhere.
Alternatively, if this isn't the intended behavior, the file-store-waldo logic in src/output-filedata.c should be changed.
Updated by Michael Stone over 4 years ago
Looking back, my initial impression was confused and then I misread the program logic. The file-store-waldo configuration directive should still be documented, but it doesn't work as described above.
Part of the confusion is that the waldo file doesn't get initialized. I'd suggest setting it to zero if it doesn't exist, so that it's clear that when the configuration is changed that there's an immediate effect.
More fundamentally, I think the current implementation is broken as far as being a useful waldo, because it seems to only be written on exit--if the suricata process crashes, the next instance will restart numbering at the same value as the previous instance, overwriting files.