From 72443a0d62fb335652f68fdc89437006ba23fb31 Mon Sep 17 00:00:00 2001
From: Victor Julien <victor@inliniac.net>
Date: Thu, 6 Dec 2012 14:48:56 +0100
Subject: [PATCH] unified2: append open instead of trucate open so that in case
 we rotate within a second we don't overwrite files. Instead we violate the
 limit.

---
 src/alert-unified2-alert.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/alert-unified2-alert.c b/src/alert-unified2-alert.c
index 07bd44d7f7..6ee07478ac 100644
--- a/src/alert-unified2-alert.c
+++ b/src/alert-unified2-alert.c
@@ -1084,7 +1084,7 @@ int Unified2AlertOpenFileCtx(LogFileCtx *file_ctx, const char *prefix)
 
     snprintf(filename, PATH_MAX, "%s/%s.%" PRIu32, log_dir, prefix, (uint32_t)ts.tv_sec);
 
-    file_ctx->fp = fopen(filename, "wb");
+    file_ctx->fp = fopen(filename, "ab");
     if (file_ctx->fp == NULL) {
         SCLogError(SC_ERR_FOPEN, "failed to open %s: %s", filename,
             strerror(errno));