Actions
Bug #4941
closedalerts: 5.0.8/6.0.4 count noalert sigs towards built-in alert limit
Description
Changes in alerting in 5.0.8/6.0.4 store noalert
sigs in the packet alert array before removing them when finalizing the alerts. This solved several issues (#4663, #4670), however it introduces a new issue.
When many noalert
rules are used, for example for flowbit "setter" logic, these rules now consume space in the alert array, leaving less space for "real" alerts that should be outputted. Since there is a built-in limit of 15 (see #4207) its not hard to reach this limit.
Updated by Victor Julien over 2 years ago
- Related to Bug #4663: rules: drop rules with noalert not fully dropping added
Updated by Victor Julien over 2 years ago
- Related to Bug #4670: rules: mix of drop and pass rules issues added
Updated by Jeff Lucovsky over 2 years ago
- Copied to Bug #5120: alerts: 5.0.8/6.0.4 count noalert sigs towards built-in alert limit (6.0.x backport) added
Updated by Jeff Lucovsky over 2 years ago
- Copied to Bug #5124: alerts: 5.0.8/6.0.4 count noalert sigs towards built-in alert limit (5.0.x backport) added
Updated by Juliana Fajardini Reichow over 2 years ago
- Assignee changed from OISF Dev to Juliana Fajardini Reichow
Updated by Juliana Fajardini Reichow over 2 years ago
I think https://github.com/OISF/suricata/pull/7347 would solve this, right?
Updated by Juliana Fajardini Reichow over 2 years ago
- Status changed from New to Resolved
Updated by Victor Julien about 2 years ago
- Status changed from Resolved to Closed
Actions