Suricata

I think the event type should be disabled by default, similar to the "drop" event type.

When it is enabled, it should default to logging for packets that:
1. have alerts
2. had a new pass action trigger (so the first pass if a flow pass was set)
3. had a new drop action trigger (so the first drop if a flow drop was set)
4. a bypass is triggered

Optionally, it should log for each packet that is dropped or "passed".