From a654ad9c9a46e0cd1f33b902d5aa1a3058787a5c Mon Sep 17 00:00:00 2001 From: Jeff Lucovsky Date: Fri, 28 Feb 2025 11:02:29 -0500 Subject: [PATCH] output/buffer: Change buffer-size default value The buffer-size value that controls file output buffering defaults to 8k. To be consistent with previous logic, the default is being changed to 0 (e.g., needed if there are old config files that don't specifically enable the new value). --- src/util-logopenfile.c | 1 + src/util-logopenfile.h | 2 +- suricata.yaml.in | 2 +- 3 files changed, 3 insertions(+), 2 deletions(-) diff --git a/src/util-logopenfile.c b/src/util-logopenfile.c index c27dcf8bab..e793850e0f 100644 --- a/src/util-logopenfile.c +++ b/src/util-logopenfile.c @@ -533,6 +533,7 @@ SCConfLogOpenGeneric(ConfNode *conf, /* Determine the buffering for this output device; a value of 0 means to not buffer; * any other value must be a multiple of 4096 + * The default value is 0 (no buffering) */ uint32_t buffer_size = LOGFILE_EVE_BUFFER_SIZE; const char *buffer_size_value = ConfNodeLookupChildValue(conf, "buffer-size"); diff --git a/src/util-logopenfile.h b/src/util-logopenfile.h index 19c9e5e1c7..735d93b56a 100644 --- a/src/util-logopenfile.h +++ b/src/util-logopenfile.h @@ -172,7 +172,7 @@ typedef struct LogFileCtx_ { #define LOGFILE_ROTATE_INTERVAL 0x04 /* Default EVE output buffering size */ -#define LOGFILE_EVE_BUFFER_SIZE (8 * 1024) +#define LOGFILE_EVE_BUFFER_SIZE 0 LogFileCtx *LogFileNewCtx(void); int LogFileFreeCtx(LogFileCtx *); diff --git a/suricata.yaml.in b/suricata.yaml.in index 40484ea1c4..4d46c2502f 100644 --- a/suricata.yaml.in +++ b/suricata.yaml.in @@ -104,7 +104,7 @@ outputs: # Specify the amount of buffering, in bytes, for # this output type. The default value 0 means "no # buffering". - buffer-size: 0 + #buffer-size: 0 #prefix: "@cee: " # prefix to prepend to each log entry # the following are valid when type: syslog above #identity: "suricata"