Task #5827: [investigate] output/drop: make `drop reason` more informative - Suricata - Open Information Security Foundation

Actions

Copy link

Task #5827

open

[investigate] output/drop: make `drop reason` more informative

Added by Juliana Fajardini Reichow almost 2 years ago. Updated 4 months ago.

Status:

New

Priority:

Normal

Assignee:

OISF Dev

Target version:

8.0.0-beta1

Effort:

Difficulty:

Label:

Description

With drops being caused by elements such as the exception policies, `drop.reason` needs more data
to be actually informative.
Two examples of drop reasons that seem to not show enough to be conclusive to users:

drop.reason: "applayer error"

drop.reason: "stream memcap"

I've created this with the [investigate] "tag" because it actually seems that each of those reasons could only happen under specific cases
- and yet, when debugging, the info might seem incomplete...