Suricata

While testing rule profiling I noticed that a filename-path of /dev/null will get appended to the log directory and end up complaining about the file not being found (like /some/path//dev/null).

profiling:
  # Run profiling for every X-th packet. The default is 1, which means we
  # profile every packet. If set to 1000, one packet is profiled for every
  # 1000 received.
  #sample-rate: 1000

  # rule profiling
  rules:

    # Profiling can be disabled here, but it will still have a
    # performance impact if compiled in.
    enabled: yes
    filename: profile.json # < this as /dev/null

Would expect the full path to be used so you can place files outside of your log directory (or log but dump in the case of /dev/null)