Suricata

Currently we can output "sort" of rule profiling: sorted by ticks, avg ticks, checks, etc. I'd like to support more. The below would output for ticks, avgticks and checks separately.

  rules:

    # Profiling can be disabled here, but it will still have a
    # performance impact if compiled in.
    enabled: yes

    # Sort options: ticks, avgticks, checks, matches
    sort: ticks, avgticks, checks

    # Limit the number of items printed at exit.
    limit: 25

Each output would also print what it's output type is.