suricata/doc
Ofer Dagan e1f9d8a067
Some checks are pending
builds / Prepare dependencies (push) Waiting to run
builds / Prepare cbindgen (push) Waiting to run
builds / AlmaLinux 10 (schema, plugins) (push) Blocked by required conditions
builds / AlmaLinux 9 (schema, rust-checks) (push) Blocked by required conditions
builds / AlmaLinux 9 Test Templates (push) Blocked by required conditions
builds / Build RPMs (push) Blocked by required conditions
builds / AlmaLinux 8 (push) Blocked by required conditions
builds / CentOS Stream 9 (push) Blocked by required conditions
builds / Fedora 43 (Suricata Verify codecov) (push) Blocked by required conditions
builds / Fedora 43 (clang, debug, asan, wshadow, rust-strict, systemd) (push) Blocked by required conditions
builds / Fedora 43 (gcc, debug, flto, asan, wshadow, rust-strict) (push) Blocked by required conditions
builds / Fedora (non-root, debug, clang, asan, wshadow, rust-strict, no-ja) (push) Blocked by required conditions
builds / AlmaLinux 9 (no jansson) (push) Blocked by required conditions
builds / AlmaLinux 9 (Minimal/Recommended Build) (push) Blocked by required conditions
builds / Ubuntu 24.04 (cocci) (push) Blocked by required conditions
builds / Ubuntu 24.04 (RUSTC+CARGO vars) (push) Blocked by required conditions
builds / Ubuntu 24.04 (unittests coverage) (push) Blocked by required conditions
builds / Ubuntu 22.04 (unix socket mode coverage) (push) Blocked by required conditions
builds / Ubuntu 22.04 (afpacket and dpdk coverage) (push) Blocked by required conditions
builds / Ubuntu 24.04 (pcap unix socket ASAN) (push) Blocked by required conditions
builds / Ubuntu 24.04 (afpacket IPS tests in namespaces) (push) Blocked by required conditions
builds / Ubuntu 24.04 (afpacket and dpdk live tests with ASAN) (push) Blocked by required conditions
builds / Ubuntu 22.04 (fuzz corpus coverage) (push) Blocked by required conditions
builds / Ubuntu 20.04 (-DNDEBUG) (push) Blocked by required conditions
builds / Ubuntu 20.04 (unsupported rust) (push) Blocked by required conditions
builds / Ubuntu 22.04 (Debug Validation) (push) Blocked by required conditions
builds / Ubuntu 22.04 (Fuzz) (push) Blocked by required conditions
builds / Ubuntu 22.04 (Netmap build) (push) Blocked by required conditions
builds / Ubuntu 22.04 (Minimal/Recommended Build) (push) Blocked by required conditions
builds / Ubuntu 22.04 (DPDK Build) (push) Blocked by required conditions
builds / Debian 12 (xdp) (push) Blocked by required conditions
builds / Debian 13 (xdp) (push) Blocked by required conditions
builds / Ubuntu 22.04 Dist Builder (push) Blocked by required conditions
builds / Debian 12 MSRV (push) Blocked by required conditions
builds / Debian 11 (push) Blocked by required conditions
builds / MacOS Latest (push) Blocked by required conditions
builds / Windows MSYS2 MINGW64 (NPcap) (push) Blocked by required conditions
builds / Windows MSYS2 MINGW64 (libpcap) (push) Blocked by required conditions
builds / Windows MSYS2 UCRT64 (libpcap) (push) Blocked by required conditions
builds / Windows MSYS2 MINGW64 (WinDivert) (push) Blocked by required conditions
builds / PF_RING (push) Blocked by required conditions
CodeQL (Rust/C) / Analyze (push) Waiting to run
docs / Prepare dependencies (push) Waiting to run
docs / Prepare cbindgen (push) Waiting to run
docs / Ubuntu 22.04 Dist Builder (push) Blocked by required conditions
Nix Env Build / tests (push) Waiting to run
Scan-build / Scan-build (push) Waiting to run
Scorecards supply-chain security / Scorecards analysis (push) Waiting to run
pcap: refactor delete-when-done to support non-alerts
Refactor pcap file deletion to use a single delete-when-done option
with three values instead of separate boolean options:
- false (default): No deletion
- true: Always delete files
- "non-alerts": Delete only files with no alerts

Also account for alerts produced by pseudo packets (flow timeout / shutdown flush):
- Introduce small capture hooks and invoke on pseudo-packet creation so the
  capture layer can retain references and observe alerts emitted after the last
  live packet
- Call the hook from both TmThreadDisableReceiveThreads and TmThreadDrainPacketThreads

Key changes:
- Replace should_delete/delete_non_alerts_only bools with enum
- Move alert counter from global to per-file PcapFileFileVars
- Relocate alert counting from PacketAlertFinalize to pcap module
- Ensure thread safety for both single and continuous pcap modes
- Add unit tests for configuration parsing and pseudo-packet alert path

The --pcap-file-delete command line option overrides YAML config
and forces "always delete" mode for backward compatibility.

Documentation updated to reflect the new three-value configuration.

Fixes OISF#7786
2026-02-18 06:16:45 +00:00
..
doxygen Added doxygen.cfg file and doc directory 2009-07-30 11:50:29 +02:00
userguide pcap: refactor delete-when-done to support non-alerts 2026-02-18 06:16:45 +00:00
AUTHORS doc: replace ohloh with openhub link 2022-01-03 11:45:43 +01:00
Basic_Setup.txt Update docs from wiki 2012-11-29 13:27:36 +01:00
INSTALL doc/install: fix minor typo 2025-10-08 21:30:02 +02:00
Makefile.am doc: remove outdated GITGUIDE 2025-10-08 21:30:02 +02:00
NEWS userguide: update references to Suricata website 2022-01-03 11:45:43 +01:00
README upated INSTALL moved other doc files to doc/ deleted Welcome 2009-11-05 17:20:08 +01:00
Setting_up_IPSinline_for_Linux.txt docs: update url to docs.suricata.io 2023-05-30 12:21:05 +02:00
Third_Party_Installation_Guides.txt Update docs from wiki 2012-11-29 13:27:36 +01:00
TODO userguide: update references to Suricata website 2022-01-03 11:45:43 +01:00