Project

General

Profile

Actions

Feature #5461

open

eve: Use threaded output by default

Added by Jeff Lucovsky 2 months ago. Updated about 2 months ago.

Status:
New
Priority:
Normal
Assignee:
Target version:
Effort:
Difficulty:
Label:

Description

Change the default configuration setting of eve-log.threaded to on (enabled).

This will yield the most performant path when writing to the eve.json file but it also imposes the following change:
  • eve.json will no longer be written to. Instead, multiple files name eve.N.json will be created (one for each Suricata thread that adds entries to the EVE log)

This requires upstream handling of the EVE log to be aware that the EVE log contents are spread among the collection of eve.N.json files. Workflow processing must be cognizant of this. Individual log entries in each file continue to be timestamped so the entries could be time-stitched into a singular storage entity.

Actions

Also available in: Atom PDF