Project

General

Profile

Actions

Bug #5120

closed

alerts: 5.0.8/6.0.4 count noalert sigs towards built-in alert limit (6.0.x backport)

Added by Jeff Lucovsky about 2 years ago. Updated almost 2 years ago.

Status:
Closed
Priority:
Normal
Target version:
Affected Versions:
Effort:
Difficulty:
Label:

Description

Changes in alerting in 5.0.8/6.0.4 store noalert sigs in the packet alert array before removing them when finalizing the alerts. This solved several issues (#4663, #4670), however it introduces a new issue.

When many noalert rules are used, for example for flowbit "setter" logic, these rules now consume space in the alert array, leaving less space for "real" alerts that should be outputted. Since there is a built-in limit of 15 (see #4207) its not hard to reach this limit.


Subtasks 3 (0 open3 closed)

Task #5122: alerts: SV test for noalert issueRejectedShivani BhardwajActions
Optimization #5125: Use configurable or more dynamic @ PACKET_ALERT_MAX@ (6.0.x backport)ClosedJuliana Fajardini ReichowActions
Optimization #5127: alerts: use alert queing in DetectEngineThreadCtx (6.0.x backport)ClosedJuliana Fajardini ReichowActions

Related issues 1 (0 open1 closed)

Copied from Suricata - Bug #4941: alerts: 5.0.8/6.0.4 count noalert sigs towards built-in alert limitClosedJuliana Fajardini ReichowActions
Actions #1

Updated by Jeff Lucovsky about 2 years ago

  • Copied from Bug #4941: alerts: 5.0.8/6.0.4 count noalert sigs towards built-in alert limit added
Actions #2

Updated by Victor Julien almost 2 years ago

  • Target version changed from 6.0.5 to 6.0.6
Actions #3

Updated by Victor Julien almost 2 years ago

  • Status changed from Assigned to Closed
  • Assignee changed from Shivani Bhardwaj to Juliana Fajardini Reichow
Actions #4

Updated by Victor Julien almost 2 years ago

  • Subject changed from alerts: 5.0.8/6.0.4 count noalert sigs towards built-in alert limit to alerts: 5.0.8/6.0.4 count noalert sigs towards built-in alert limit (6.0.x backport)
Actions

Also available in: Atom PDF