add system mode and user mode
Add distinction between system and user modes, where the normal IDS modes are system modes, but the offline pcap runmodes are not.
For the user mode, the default log dir should be ignored and the current work dir should be used instead.
Updated by Victor Julien about 6 years ago
Some tools make a distinction between a 'user mode' and a 'system mode'. Perhaps something similar would make sense here. The regular IDS/IPS modes would count as 'system modes' where the default log location (e.g. /var/log/suricata) makes sense. A user processing a pcap file would count as a 'user mode' where the output should probably go to another location. Perhaps there it would make sense to write output to the CWD (iirc Bro does this).
Updated by Jason Ish about 6 years ago
I like what Victor is suggesting. Perhaps for pcaps the default log directory should be "." regardless of whats in the config file. Even if running as root, you wouldn't want to clobber the default log directory if Suricata is running as a daemon.
I more often than not do something like "-l ." or "-l ./log" when using pcaps.
Updated by Richard Sailer about 6 years ago
I also think a distinction between 'user mode' and 'system mode' would make sense.
But this opens a new question: How fundamental should that distinction be and how exactly should it manifest?
- Would it make sense to have a own user interface (like a wrapper script) with a own manpage for the 'user mode' usage
(This could add/consolidate more 'user mode like' features into this script, and give nicer usability)
- Would it make sense to have a own (small) chapter in the user guide for "user mode usage" of suricata.
Updated by Danny Browning over 5 years ago
Maybe just a --daemon or --server option?
Uses /var/log, enables unix socket, turns on capture, etc. Config would still take priority, but if not set, has default behavior. Thinking a flag like that would be useful for things like state serialization and log rolling, without needing them specified.
Updated by Victor Julien almost 5 years ago
- Subject changed from Warn user if -r (pcap offline mode) is used with default log dir to add system mode and user mode
- Status changed from New to Assigned
- Assignee changed from Community Ticket to Victor Julien
- Target version changed from TBD to 5.0beta1
- Effort deleted (
- Difficulty deleted (