Commit Graph

7 Commits (1328ecb8f6e981f6ce47704b17d7884f21d1d4cc)

Author SHA1 Message Date
Gaurav Singh 637a7c8e55 Adds options to mark when a file is final.
This takes the form of an option to add the pid of the process to file
names. Additionally, it adds a suffix to the file name to indicate it is
not finalized.

Adding the pid to the file name reduces the likelihood that a file is
overwritten when suricata is unexpectedly killed. The number in the
waldo file is only written out during a clean shutdown. In the event
of an improper shutdown, extracted files will be written using the old
number and existing files with the same name will be overwritten.

Writes extracted files and their metadata to a temporary file suffixed
with '.tmp'. Renames the files when they are completely done being
written. As-is there is no way to know that a file on disk is still
being written to by suricata.
7 years ago
Eric Leblond e933eb849a doc: document filestore update 8 years ago
Jason Ish cd4c9e73f8 doc: fix sphinx warnings
This involved removing documents that were intentionally
not referenced as they are not good candidates for the
user guide.
9 years ago
Giuseppe Longo 3f214b506a file-store: add depth setting
When a rules match and fired filestore we may want
to increase the stream reassembly depth for this specific.

This add the 'depth' setting in file-store config,
which permits to specify how much data we want to reassemble
into a stream.
9 years ago
Victor Julien 7011d8f34c doc: remove/cleanup 'guides' 9 years ago
Andreas Herz 7806ae8f57 docs: sync up to recent redmine 9 years ago
Jason Ish 2751baae46 doc: rename from "sphinx" to "userguide" 9 years ago