filestore to uses rename syscall instead of sendfile,which doesn't allow files to be sent across file systems
I would very much like to use tmpfs for the spool dir for the suricata filestore feature to minimize disk I/O and associated thrashing.
However, since suricata uses the 'rename' syscall it doesn't allow the tmp files to be moved across filesystems. So this doesn't work.
If this is changed to use the 'sendfile' syscall it should work.