You cannot select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
suricata/doc/userguide
Lukas Sismis da64eace18 util/log: rotate calendar intervals on local-time boundaries
With rotate-interval set to minute, hour or day, rotations were not
aligned to the local time boundaries. The first rotation was computed
by SCGetSecondsUntil(), which overshoots the next hour by one minute
(hh:01:00) and the next day by one hour and one minute (01:01:00).
Every following rotation was re-armed with a fixed interval
(e.g. 86400 s) from the time of the rotation.

Local days are not always 86400 s long, so the day rotation also moved
by the DST shift on every DST transition and stayed there until the
next one. A file named after a date then held events of the next day.

Instead, this commit rotates logs when the local minute, hour or date
changes. The daily rotation now happens at local midnight.
On SIGHUP, the period is recorded before the file is reopened, so a boundary
(the next minute/hour/day) passing during the reopen leads to an extra
reopen instead of a missed rotation.

Ticket: #9139
5 days ago
..
3rd-party-integration
…
_static
…
appendix
…
capture-hardware pcap-file: skip setvbuf on non-seekable streams 5 months ago
configuration nfs: enforce max read/write queue size and count limits 2 months ago
devguide doc: update the SSH docs for the reworked state machine 3 weeks ago
file-extraction
…
firewall firewall: reject flow scope for the pre-flow hook 3 weeks ago
install
…
ips
…
licenses
…
lua doc: update the SSH docs for the reworked state machine 3 weeks ago
manpages doc: improve manpage of suricatasc 5 months ago
output util/log: rotate calendar intervals on local-time boundaries 5 days ago
partials doc: list-keywords with json output 3 weeks ago
performance http-log: remove support for http-log 5 months ago
plugins
…
protocols
…
reputation
…
rule-management
…
rules docs: note about no config action support in fw mode 1 week ago
upgrade
…
.gitignore
…
Makefile.am
…
Makefile.sphinx
…
README.md
…
acknowledgements.rst
…
command-line-options.rst
…
conf.py doc: address config conversion note 6 months ago
convert.py
…
docutils.conf
…
generate-evedoc.sh
…
index.rst
…
initscripts.rst
…
install.rst doc: update Rust installation instructions 2 months ago
make-sense-alerts.rst
…
public-data-sets.rst
…
quickstart.rst doc: clarify suricata.yaml location per install 4 months ago
requirements.txt
…
security.rst
…
support-status.rst
…
unix-socket.rst
…
upgrade.rst doc: update the SSH docs for the reworked state machine 3 weeks ago
verifying-source-files.rst
…
what-is-suricata.rst
…

README.md

Suricata User Guide

This directory contains the Suricata Guide. The Suricata Developer's guide is included as a chapter of the Guide. The Sphinx Document Generator is used to build the documentation. For a primer os reStructuredText see the reStructuredText Primer.

Verifying Changes

There are a number of output formats to choose from when making the source documentation locally (e.g. html, pdf, man).

The documentation source can be built with make -f Makefile.sphinx html. Substitute the 'html' word for desired output format.

There are different application dependencies based on the output desired.