mirror of https://github.com/OISF/suricata
You cannot select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
42 lines
1.8 KiB
ReStructuredText
42 lines
1.8 KiB
ReStructuredText
.. _filestore-update-v1-to-v2:
|
|
|
|
Update File-store v1 Configuration to V2
|
|
========================================
|
|
|
|
Given a file-store configuration like::
|
|
|
|
- file-store:
|
|
enabled: yes # set to yes to enable
|
|
log-dir: files # directory to store the files
|
|
force-magic: no # force logging magic on all stored files
|
|
force-hash: [md5] # force logging of md5 checksums
|
|
force-filestore: no # force storing of all files
|
|
stream-depth: 1mb # reassemble 1mb into a stream, set to no to disable
|
|
waldo: file.waldo # waldo file to store the file_id across runs
|
|
max-open-files: 0 # how many files to keep open (O means none)
|
|
write-meta: yes # write a .meta file if set to yes
|
|
include-pid: yes # include the pid in filenames if set to yes.
|
|
|
|
The following changes will need to be made to convert to a v2 style configuration:
|
|
|
|
* The ``version`` field must be set to 2.
|
|
* The ``log-dir`` field should be renamed to ``dir``. It is recommended to use a new directory instead of an existing v1 directory.
|
|
* Remove the ``waldo`` option. It is no longer used.
|
|
* Remove the ``write-meta`` option.
|
|
* Optionally set ``write-fileinfo`` to enable writing of a metadata file along side the extracted file. Not that this option is disabled by default as a ``fileinfo`` event can be written to the Eve log file.
|
|
* Remove the ``include-pid`` option. There is no equivalent to this option in file-store v2.
|
|
|
|
Example converted configuration::
|
|
|
|
- file-store:
|
|
version: 2
|
|
enabled: yes
|
|
dir: filestore
|
|
force-hash: [md5]
|
|
file-filestore: no
|
|
stream-depth: 1mb
|
|
max-open-files: 0
|
|
write-fileinfo: yes
|
|
|
|
Refer to the :ref:`File Extraction` section of the manual for information about the format of the file-store directory for file-store v2.
|