Project

General

Profile

Actions
Copy link

Bug #2493

closed
DB

EngineAnalysisRules2 File Output Cannot Be Adjusted

Bug #2493: EngineAnalysisRules2 File Output Cannot Be Adjusted

Added by Danny Browning over 8 years ago. Updated over 7 years ago.

Status:
Closed
Priority:
Normal
Assignee:
-
Target version:
-
Affected Versions:
4.1beta1
Effort:
Difficulty:
Label:

Description

Putting this as a bug since as rule reloads occur, the file will continue to grow without bounds or limits.

EngineAnalysisRules2 uses a hardcoded rules.json file in the default output directory to output rules analysis information. This path and whether or not analysis is output should be configurable.

DB Updated by Danny Browning over 8 years ago Actions
Copy link
 #1

Related MR: https://github.com/OISF/suricata/pull/3346

This method seems to still be in development, and per documentation should only be called when running with --engine-analysis, so there might be a different solution needed.

AH Updated by Andreas Herz over 8 years ago Actions
Copy link
 #2

  • Assignee set to Danny Browning
  • Target version set to TBD

Do you want to work on that further?

JM Updated by Jacob Masen-Smith over 8 years ago Actions
Copy link
 #3

Is there any particular reason EngineAnalysisRules2 is called where it is? EngineAnalysisRules is called in a completely separate location yet with the same arguments, in a way that respects the `engine-analysis` flag.

DB Updated by Danny Browning over 8 years ago Actions
Copy link
 #4

I think Jacob's solution is better than mine, although I'm not sure why there is a profiling config section and the command line argument.

VJ Updated by Victor Julien over 7 years ago Actions
Copy link
 #5

  • Status changed from New to Closed
  • Assignee deleted (Danny Browning)
  • Target version deleted (TBD)

I believe this has been fixed.

Actions
Copy link

Also available in: PDF Atom