Project

General

Profile

Actions
Copy link

Bug #5124

closed
JL JF

alerts: 5.0.8/6.0.4 count noalert sigs towards built-in alert limit (5.0.x backport)

Bug #5124: alerts: 5.0.8/6.0.4 count noalert sigs towards built-in alert limit (5.0.x backport)

Added by Jeff Lucovsky about 4 years ago. Updated almost 4 years ago.

Status:
Closed
Priority:
Normal
Assignee:
Juliana Fajardini Reichow
Target version:
5.0.10
Affected Versions:
5.0.8, 6.0.4
Effort:
Difficulty:
Label:

Description

Changes in alerting in 5.0.8/6.0.4 store noalert sigs in the packet alert array before removing them when finalizing the alerts. This solved several issues (#4663, #4670), however it introduces a new issue.

When many noalert rules are used, for example for flowbit "setter" logic, these rules now consume space in the alert array, leaving less space for "real" alerts that should be outputted. Since there is a built-in limit of 15 (see #4207) its not hard to reach this limit.

Subtasks 3 (0 open — 3 closed)

Optimization #5121: Use configurable or more dynamic @ PACKET_ALERT_MAX@ (5.0.x backport)ClosedJuliana Fajardini ReichowActions
Optimization #5123: alerts: use alert queing in DetectEngineThreadCtx (5.0.x backport)ClosedJuliana Fajardini ReichowActions
Task #5126: alerts: SV test for noalert issueRejectedShivani BhardwajActions

Related issues 1 (0 open — 1 closed)

Copied from Suricata - Bug #4941: alerts: 5.0.8/6.0.4 count noalert sigs towards built-in alert limitClosedJuliana Fajardini ReichowActions

JL Updated by Jeff Lucovsky about 4 years ago Actions
Copy link
 #1

  • Copied from Bug #4941: alerts: 5.0.8/6.0.4 count noalert sigs towards built-in alert limit added

VJ Updated by Victor Julien about 4 years ago Actions
Copy link
 #2

  • Target version changed from 5.0.9 to 5.0.10

VJ Updated by Victor Julien almost 4 years ago Actions
Copy link
 #3

  • Status changed from Assigned to In Review
  • Assignee changed from Jeff Lucovsky to Juliana Fajardini Reichow

VJ Updated by Victor Julien almost 4 years ago Actions
Copy link
 #4

  • Subject changed from alerts: 5.0.8/6.0.4 count noalert sigs towards built-in alert limit to alerts: 5.0.8/6.0.4 count noalert sigs towards built-in alert limit (5.0.x backport)

JF Updated by Juliana Fajardini Reichow almost 4 years ago Actions
Copy link
 #5

  • Status changed from In Review to Resolved

JF Updated by Juliana Fajardini Reichow almost 4 years ago Actions
Copy link
 #6

  • Status changed from Resolved to Closed
Actions
Copy link

Also available in: PDF Atom