From 90a837cef3b7c5f308ba6f797620eb8c5645bcee Mon Sep 17 00:00:00 2001 From: Victor Julien Date: Wed, 27 May 2026 09:15:36 +0200 Subject: [PATCH] detect/firewall: update discarded logic Only count alert queue overflow here, not alerts in the queue after a drop. --- doc/userguide/firewall/firewall-stats.rst | 5 ++++- etc/schema.json | 2 +- src/detect-engine-alert.c | 3 +-- 3 files changed, 6 insertions(+), 4 deletions(-) diff --git a/doc/userguide/firewall/firewall-stats.rst b/doc/userguide/firewall/firewall-stats.rst index f681331df2..d8561e34dc 100644 --- a/doc/userguide/firewall/firewall-stats.rst +++ b/doc/userguide/firewall/firewall-stats.rst @@ -29,6 +29,9 @@ If a drop was caused by the firewall, the corresponding counter will be incremen Discarded alerts ================ -In Firewall mode, alerts generated *after* a drop are discarded. +When the alert queue is full for a firewall rule match, the alert is discarded. These are reported with the counter ``stats.firewall.discarded_alerts``. Note that the drop may be caused by non-firewall rules. + +The rule's primary action as well as other secondary actions will be applied to +the traffic as normal. diff --git a/etc/schema.json b/etc/schema.json index 72fc10bf6e..9794c439a8 100644 --- a/etc/schema.json +++ b/etc/schema.json @@ -7549,7 +7549,7 @@ }, "discarded_alerts": { "type": "integer", - "description": "Count of alerts discarded due to a drop while in firewall mode" + "description": "Count of alerts discarded due max alerts reached" }, "drop_reason": { "type": "object", diff --git a/src/detect-engine-alert.c b/src/detect-engine-alert.c index c93cf28fab..5bf150115f 100644 --- a/src/detect-engine-alert.c +++ b/src/detect-engine-alert.c @@ -632,8 +632,7 @@ static inline void PacketAlertFinalizeProcessQueue( } if (dropped) { - SCLogDebug("Skippig firewall signature after a drop."); - p->alerts.firewall_discarded++; + SCLogDebug("Skipping firewall signature after a drop."); continue; }