diff --git a/src/detect-engine-alert.c b/src/detect-engine-alert.c index ae88eb66f4..b1a3151e4e 100644 --- a/src/detect-engine-alert.c +++ b/src/detect-engine-alert.c @@ -19,6 +19,7 @@ #include "suricata.h" #include "detect.h" +#include "detect-parse.h" #include "detect-engine-alert.h" #include "detect-engine-threshold.h" #include "detect-engine-tag.h" @@ -158,7 +159,7 @@ static inline void RuleActionToFlow(const uint8_t action, Flow *f, const bool fw { if (action & ACTION_ACCEPT) { f->flags |= FLOW_ACTION_ACCEPT; - SCLogDebug("setting flow action pass"); + SCLogDebug("setting flow action accept"); } /* pass:flow can be set if accept:flow is present */ @@ -200,8 +201,8 @@ static inline void RuleActionToFlow(const uint8_t action, Flow *f, const bool fw * \param pa packet alert struct -- match, including actions after thresholding (rate_filter) */ static void PacketApplySignatureActions(Packet *p, const Signature *s, const PacketAlert *pa) { - SCLogDebug("packet %" PRIu64 " sid %u action %02x alert_flags %02x", PcapPacketCntGet(p), s->id, - pa->action, pa->flags); + SCLogDebug("packet %" PRIu64 ", sid %u: action %02x alert_flags %02x", PcapPacketCntGet(p), + s->id, pa->action, pa->flags); const bool is_fw_rule = s->flags & SIG_FLAG_FIREWALL ? true : false; /* REJECT also sets ACTION_DROP, just make it more visible with this check */ @@ -387,7 +388,7 @@ void AlertQueueAppend(DetectEngineThreadCtx *det_ctx, const Signature *s, Packet /* we do that even before inserting into the queue, so we save it even if appending fails */ if (p->alerts.drop.action == 0 && s->action & ACTION_DROP) { p->alerts.drop = PacketAlertSet(det_ctx, s, tx_id, alert_flags); - SCLogDebug("Set PacketAlert drop action. s->iid %" PRIu32 "", s->iid); + SCLogDebug("sid %u: set PacketAlert drop action. s->iid %" PRIu32 "", s->id, s->iid); } uint16_t pos = det_ctx->alert_queue_size; @@ -401,7 +402,8 @@ void AlertQueueAppend(DetectEngineThreadCtx *det_ctx, const Signature *s, Packet } det_ctx->alert_queue[pos] = PacketAlertSet(det_ctx, s, tx_id, alert_flags); - SCLogDebug("Appending sid %" PRIu32 ", s->iid %" PRIu32 " to alert queue", s->id, s->iid); + SCLogDebug("packet %" PRIu64 ": appending sid %" PRIu32 ", s->iid %" PRIu32 " to alert queue", + PcapPacketCntGet(p), s->id, s->iid); det_ctx->alert_queue_size++; }