pcap-file: advance the directory watermark for all files

In continuous pcap-file directory mode, a file that makes InitPcapFile()
fail (malformed content, not a pcap, unsupported link type, truncated
header) was skipped without folding its mtime into last_time_seen.
This caused the file(s) to be reinspected on every follow-up poll until
a newer valid file was processed.

Ticket: 9129
pull/16497/head
Lukas Sismis 1 month ago committed by Victor Julien
parent 4488424129
commit 3fe8ac21d0

@ -431,6 +431,9 @@ TmEcode PcapDirectoryDispatchForTimeRange(PcapFileDirectoryVars *pv,
if (InitPcapFile(pftv) == TM_ECODE_FAILED) {
SCLogWarning("Failed to init pcap file %s, skipping", current_file->filename);
if (CompareTimes(&current_file->modified_time, &last_time_seen) > 0) {
CopyTime(&current_file->modified_time, &last_time_seen);
}
CleanupPendingFile(current_file);
CleanupPcapFileFileVars(pftv);
status = TM_ECODE_OK;

Loading…
Cancel
Save