Project

General

Profile

Actions
Copy link

Optimization #5178

closed

Bug #4941: alerts: 5.0.8/6.0.4 count noalert sigs towards built-in alert limit

Optimization #4207: Use configurable or more dynamic @ PACKET_ALERT_MAX@

detect/alert: improve packet alert queue handling

Added by Juliana Fajardini Reichow about 2 years ago. Updated almost 2 years ago.

Status:
Rejected
Priority:
Normal
Assignee:
Juliana Fajardini Reichow
Target version:
-
Effort:
Difficulty:
Label:

Description

With the change from a fixed size to a configurable packet alert queue (max), some issues with how the current queue is handled were exposed.

Improve that, to ensure there are no memory leaks with the dynamic allocation of the packet alerts queue.
--------------
This task will most likely be done as a backports-only candidate, in favour of the approach proposed by #5123 from 7.0.x onwards.

Related issues 3 (1 open — 2 closed)

Related to Suricata - Task #5179: stats/alert: log out to stats alerts that have been discarded from packet queueClosedJuliana Fajardini ReichowActions
Related to Suricata - Optimization #5180: detect/alert: make sure that signatures with `drop` action are respected, even if the alert is discardedIn ProgressJuliana Fajardini ReichowActions
Related to Suricata - Optimization #5123: alerts: use alert queing in DetectEngineThreadCtx (5.0.x backport)ClosedJuliana Fajardini ReichowActions
Actions
Copy link
 #1

Updated by Juliana Fajardini Reichow about 2 years ago

  • Related to Task #5179: stats/alert: log out to stats alerts that have been discarded from packet queue added
Actions
Copy link
 #2

Updated by Juliana Fajardini Reichow about 2 years ago

  • Related to Optimization #5180: detect/alert: make sure that signatures with `drop` action are respected, even if the alert is discarded added
Actions
Copy link
 #3

Updated by Juliana Fajardini Reichow about 2 years ago

  • Related to Optimization #5123: alerts: use alert queing in DetectEngineThreadCtx (5.0.x backport) added
Actions
Copy link
 #4

Updated by Juliana Fajardini Reichow about 2 years ago

  • Description updated (diff)
  • Target version changed from 7.0.0-beta1 to TBD
Actions
Copy link
 #5

Updated by Juliana Fajardini Reichow about 2 years ago

  • Status changed from New to In Progress
Actions
Copy link
 #6

Updated by Juliana Fajardini Reichow about 2 years ago

  • Status changed from In Progress to In Review
Actions
Copy link
 #7

Updated by Juliana Fajardini Reichow about 2 years ago

Will stop current work on this issue because we will try to follow the approach for #4943, and which could lead to a simpler/less convoluted way of handling the packet alert queue.

Actions
Copy link
 #8

Updated by Juliana Fajardini Reichow almost 2 years ago

  • Status changed from In Review to Closed
Actions
Copy link
 #9

Updated by Juliana Fajardini Reichow almost 2 years ago

  • Status changed from Closed to Rejected
  • Target version deleted (TBD)
Actions
Copy link

Also available in: Atom PDF