Suricata

suricata is logging tls log repeatedly if custom mode is enabled. It is not flushing buffer if custom logging is enabled.

This is code in log-tlslog.c

    if (hlog->flags & LOG_TLS_CUSTOM) {
        LogTlsLogCustom(aft, ssl_state, &p->ts, srcip, sp, dstip, dp);
    } else {
        MemBufferReset(aft->buffer);
        ...
    }