Project

General

Profile

Actions

Optimization #5127

closed

Bug #5120: alerts: 5.0.8/6.0.4 count noalert sigs towards built-in alert limit (6.0.x backport)

alerts: use alert queing in DetectEngineThreadCtx (6.0.x backport)

Added by Jeff Lucovsky over 2 years ago. Updated almost 2 years ago.

Status:
Closed
Priority:
Normal
Target version:
Effort:
Difficulty:
Label:

Description

Currently each alert is written directly to Packet::alerts during rule evaluation. Then at the end of the detection run for a packet, PacketAlertFinalize removes entries again, when applying thresholding, suppression and noalert. This leads to the issue in #4941 but is often also not very efficient esp when there are multiple rules to remove.

The idea of this ticket is to use a per DetectEngineThreadCtx specific queue of some sort to store the alert "candidates" and have PacketAlertFinalize only write the final alerts to the Packet structure.


Related issues 1 (0 open1 closed)

Copied from Suricata - Optimization #4943: alerts: use alert queing in DetectEngineThreadCtxClosedJuliana Fajardini ReichowActions
Actions

Also available in: Atom PDF