Project

General

Profile

Actions

Optimization #5178

closed

Bug #4941: alerts: 5.0.8/6.0.4 count noalert sigs towards built-in alert limit

Optimization #4207: Use configurable or more dynamic @ PACKET_ALERT_MAX@

detect/alert: improve packet alert queue handling

Added by Juliana Fajardini Reichow 9 months ago. Updated 7 months ago.

Status:
Rejected
Priority:
Normal
Target version:
-
Effort:
Difficulty:
Label:

Description

With the change from a fixed size to a configurable packet alert queue (max), some issues with how the current queue is handled were exposed.

Improve that, to ensure there are no memory leaks with the dynamic allocation of the packet alerts queue.
--------------
This task will most likely be done as a backports-only candidate, in favour of the approach proposed by #5123 from 7.0.x onwards.


Related issues 3 (1 open2 closed)

Related to Task #5179: stats/alert: log out to stats alerts that have been discarded from packet queueClosedJuliana Fajardini ReichowActions
Related to Task #5180: detect/alert: make sure that signatures with `drop` action are respected, even if the alert is discardedIn ProgressJuliana Fajardini ReichowActions
Related to Optimization #5123: alerts: use alert queing in DetectEngineThreadCtx (5.0.x backport)ClosedJuliana Fajardini ReichowActions
Actions #1

Updated by Juliana Fajardini Reichow 9 months ago

  • Related to Task #5179: stats/alert: log out to stats alerts that have been discarded from packet queue added
Actions #2

Updated by Juliana Fajardini Reichow 9 months ago

  • Related to Task #5180: detect/alert: make sure that signatures with `drop` action are respected, even if the alert is discarded added
Actions #3

Updated by Juliana Fajardini Reichow 9 months ago

  • Related to Optimization #5123: alerts: use alert queing in DetectEngineThreadCtx (5.0.x backport) added
Actions #4

Updated by Juliana Fajardini Reichow 9 months ago

  • Description updated (diff)
  • Target version changed from 7.0.0-beta1 to TBD
Actions #5

Updated by Juliana Fajardini Reichow 9 months ago

  • Status changed from New to In Progress
Actions #6

Updated by Juliana Fajardini Reichow 9 months ago

  • Status changed from In Progress to In Review
Actions #7

Updated by Juliana Fajardini Reichow 8 months ago

Will stop current work on this issue because we will try to follow the approach for #4943, and which could lead to a simpler/less convoluted way of handling the packet alert queue.

Actions #8

Updated by Juliana Fajardini Reichow 7 months ago

  • Status changed from In Review to Closed
Actions #9

Updated by Juliana Fajardini Reichow 7 months ago

  • Status changed from Closed to Rejected
  • Target version deleted (TBD)
Actions

Also available in: Atom PDF