Suricata

The unified file rollover functions cause a segmentation fault. I believe that the reason is related to the rollover functions in the unified*.c files. They are all setup up similar to this.

int AlertUnifiedLogRotateFile(ThreadVars *t, AlertUnifiedLogThread *aun) {
if (AlertUnifiedLogCloseFile(t,aun) < 0) {
printf("Error: AlertUnifiedLogCloseFile failed\n");
return -1;
}

if (AlertUnifiedLogOpenFileCtx(aun->file_ctx, aun->file_ctx->config_file) < 0) {
        printf("Error: AlertUnifiedLogOpenFileCtx, open new log file failed\n");
        return -1;
    }
    if (AlertUnifiedLogWriteFileHeader(t, aun) < 0) {
        printf("Error: AlertUnifiedLogAppendFile, write unified header failed\n");
        return -1;
    }
    return 0;
}

But inside of AlertUnifiedLogOpenFileCtx if the value of config_file isn't NULL we don't assign a new value for a file to be opened.

Not sure if this is correct but I could work around the issue by inserting the line aun->file_ctx->config_file = NULL; before the call to AlertUnifiedLogOpenFileCtx()..

int AlertUnifiedLogRotateFile(ThreadVars *t, AlertUnifiedLogThread *aun) {
if (AlertUnifiedLogCloseFile(t,aun) < 0) {
printf("Error: AlertUnifiedLogCloseFile failed\n");
return -1;
}

aun->file_ctx->config_file = NULL; /* XXX delete me when config file is implimented */
    if (AlertUnifiedLogOpenFileCtx(aun->file_ctx, aun->file_ctx->config_file) < 0) {
        printf("Error: AlertUnifiedLogOpenFileCtx, open new log file failed\n");
        return -1;
    }
    if (AlertUnifiedLogWriteFileHeader(t, aun) < 0) {
        printf("Error: AlertUnifiedLogAppendFile, write unified header failed\n");
        return -1;
    }
    return 0;
}