log-pcap: remove early output initializing if offline

Remove early opening of output files if running in an offline mode, as
we don't yet know the timestamp to use.

Prevents the first pcap files being opened with a timestamp of 0,
bringing us back to the same behvaviour of pcap logging in 6.0.

Issue: 5374
pull/8430/head
Jason Ish 3 years ago committed by Victor Julien
parent 64c069f162
commit 30a2cfa693

@ -1104,11 +1104,14 @@ static TmEcode PcapLogDataInit(ThreadVars *t, const void *initdata, void **data)
#endif /* INIT_RING_BUFFER */
}
if (pl->mode == LOGMODE_MULTI) {
PcapLogOpenFileCtx(td->pcap_log);
} else {
if (pl->filename == NULL) {
PcapLogOpenFileCtx(pl);
/* Don't early initialize output files if in a PCAP file mode. */
if (IsRunModeOffline(RunmodeGetCurrent())) {
if (pl->mode == LOGMODE_MULTI) {
PcapLogOpenFileCtx(td->pcap_log);
} else {
if (pl->filename == NULL) {
PcapLogOpenFileCtx(pl);
}
}
}

Loading…
Cancel
Save