Suricata

Jamie Lavigne wrote in #note-1:

Jamie Lavigne wrote:

Importantly, the counters should be enabled for all values of the exception policy (including "ignore") so that it's possible to know the impact they will have before they are enabled.

I suppose alternately an exception policy value like "count" would work for this.

Do you mean like besides `pass-flow`, `pass-packet`, `bypass`, `reject`, `drop-flow`, `drop-packet`, and `ignore`, there could also be a `count` value?
I'm thinking that the counters could be enabled, maybe under the Exception-policy master-switch.

I was thinking that the `exception-policy` stats counter could look something like:

{
   "exception_policy":{
      "totals":{
         "drop-flow":4,
         "drop-pkt":4,
         "pass-flow":3,
         "pass-pkt":0,
         "bypass":0,
         "ignore":15
      },
      "stream":{
         "memcap":{
            "policy":"drop-flow",
            "counter":0
         },
         "midstream":{
            "policy":"pass-flow",
            "counter":3
         },
         "reassembly_memcap":{
            "policy":"ignore",
            "counter":8
         }
      },
      "app_layer_error":{
         "policy":"drop-pkt",
         "counter":4
      },
      "defrag_memcap":{
         "policy":"drop-flow",
         "counter":4
      },
      "flow_memcap":{
         "policy":"ignore",
         "counter":7
      }
   }
}

Would this be: useful? Or too verbose?