Documentation #2266
closedno documentation for file-store-waldo
Description
suricata.yaml.in includes a "waldo" line, but that seems to be ignored unless there is a "file-store-waldo: yes" line elsewhere in suricata.yaml. As far as I can tell, there is no documentation at all for file-store-waldo. It would be good both to include it in suricata.yaml.in as well as to mention in the existing waldo line that it needs to be enabled elsewhere.
Alternatively, if this isn't the intended behavior, the file-store-waldo logic in src/output-filedata.c should be changed.
Updated by Andreas Herz almost 7 years ago
- Tracker changed from Bug to Optimization
- Assignee set to OISF Dev
- Target version set to TBD
Updated by Michael Stone almost 7 years ago
Looking back, my initial impression was confused and then I misread the program logic. The file-store-waldo configuration directive should still be documented, but it doesn't work as described above.
Part of the confusion is that the waldo file doesn't get initialized. I'd suggest setting it to zero if it doesn't exist, so that it's clear that when the configuration is changed that there's an immediate effect.
More fundamentally, I think the current implementation is broken as far as being a useful waldo, because it seems to only be written on exit--if the suricata process crashes, the next instance will restart numbering at the same value as the previous instance, overwriting files.
Updated by Victor Julien almost 7 years ago
- Target version changed from TBD to Documentation
Updated by Victor Julien over 5 years ago
- Assignee changed from OISF Dev to Community Ticket
Updated by Victor Julien over 5 years ago
- Target version changed from Documentation to TBD
Updated by Andreas Herz about 5 years ago
- Tracker changed from Optimization to Documentation
Updated by Victor Julien about 5 years ago
- Related to Task #2959: deprecate: filestore v1 added
Updated by Victor Julien about 5 years ago
Filestore v1 will be removed soon, and with it the waldo functionality. It would be good to add docs for v1 to current versions, but as we recommend ppl to use v2 I see it as low priority.
Updated by Philippe Antoine over 2 years ago
- Status changed from New to Closed
Closing as file-store-waldo no longer exists