Feature #7830
open
hyperscan: support cache invalidation and removal
Added by Lukas Sismis about 2 months ago.
Updated about 14 hours ago.
Description
To avoid cluttering machines with (hyperscan) cache files, Suricata should also support automatic removal of unused cache files.
This can mean removal of unused caches right away or removal of unused caches in the last, e.g., 10 days.
needs backport to 8 when the label will be available.
Related issues
1 (1 open — 0 closed)
- Copied to Feature #7893: hyperscan: support cache invalidation and removal (8.0.x backport) added
I identified three different scenarios that are possible to trigger cache eviction:
- on startup, delete every cache that is not used in the current run.
- delete every cache file older than <time in days/minutes/seconds>.
- set a disk memcap on the cache folder. Do not save more cache files than what is specified.
The first two are the main priority. The third can be an extension as it would stop creating the caches on memcap hit, and over time, it would fill in the right caches.
Suricata will likely need to keep a side file where metainformation about the last caches used will be noted, as we cannot rely on atime (it might be turned off).
- Status changed from Assigned to In Progress
Also available in: Atom
PDF