You cannot select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
suricata/doc/userguide
Lukas Sismis da64eace18 util/log: rotate calendar intervals on local-time boundaries
With rotate-interval set to minute, hour or day, rotations were not
aligned to the local time boundaries. The first rotation was computed
by SCGetSecondsUntil(), which overshoots the next hour by one minute
(hh:01:00) and the next day by one hour and one minute (01:01:00).
Every following rotation was re-armed with a fixed interval
(e.g. 86400 s) from the time of the rotation.

Local days are not always 86400 s long, so the day rotation also moved
by the DST shift on every DST transition and stayed there until the
next one. A file named after a date then held events of the next day.

Instead, this commit rotates logs when the local minute, hour or date
changes. The daily rotation now happens at local midnight.
On SIGHUP, the period is recorded before the file is reopened, so a boundary
(the next minute/hour/day) passing during the reopen leads to an extra
reopen instead of a missed rotation.

Ticket: #9139
5 days ago
..
3rd-party-integration
…
_static
…
appendix doc: adjust for master to main rename 1 year ago
capture-hardware pcap-file: skip setvbuf on non-seekable streams 5 months ago
configuration nfs: enforce max read/write queue size and count limits 2 months ago
devguide doc: update the SSH docs for the reworked state machine 3 weeks ago
file-extraction doc: minor verbiage tweaks and reST fix 1 year ago
firewall firewall: reject flow scope for the pre-flow hook 3 weeks ago
install doc/userguide: update windivert instructions 11 months ago
ips src: doc: remove double-space typos 10 months ago
licenses
…
lua doc: update the SSH docs for the reworked state machine 3 weeks ago
manpages doc: improve manpage of suricatasc 5 months ago
output util/log: rotate calendar intervals on local-time boundaries 5 days ago
partials doc: list-keywords with json output 3 weeks ago
performance http-log: remove support for http-log 5 months ago
plugins
…
protocols doc/userguide: add initial protocols overview 1 year ago
reputation
…
rule-management userguide: add references to rules/README to docs 8 months ago
rules docs: note about no config action support in fw mode 1 week ago
upgrade doc: upgrade notes for changes to ike output 1 year ago
.gitignore
…
Makefile.am userguide/Makefile: don't add "install" to EXTRA_DIST 9 months ago
Makefile.sphinx
…
README.md
…
acknowledgements.rst doc: Add missing contributors to ack file 1 year ago
command-line-options.rst
…
conf.py doc: address config conversion note 6 months ago
convert.py
…
docutils.conf
…
generate-evedoc.sh
…
index.rst doc/userguide: add initial protocols overview 1 year ago
initscripts.rst
…
install.rst doc: update Rust installation instructions 2 months ago
make-sense-alerts.rst
…
public-data-sets.rst doc: add more public datasets 8 months ago
quickstart.rst doc: clarify suricata.yaml location per install 4 months ago
requirements.txt
…
security.rst doc: fix typo /var/run/suricata in file permissions docs. 1 year ago
support-status.rst
…
unix-socket.rst doc: adjust for master to main rename 1 year ago
upgrade.rst doc: update the SSH docs for the reworked state machine 3 weeks ago
verifying-source-files.rst docs: use correct suricata version mentions 10 months ago
what-is-suricata.rst
…

README.md

Suricata User Guide

This directory contains the Suricata Guide. The Suricata Developer's guide is included as a chapter of the Guide. The Sphinx Document Generator is used to build the documentation. For a primer os reStructuredText see the reStructuredText Primer.

Verifying Changes

There are a number of output formats to choose from when making the source documentation locally (e.g. html, pdf, man).

The documentation source can be built with make -f Makefile.sphinx html. Substitute the 'html' word for desired output format.

There are different application dependencies based on the output desired.