Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

logging - non-blocking writes to socket - v3 #2651

Closed
wants to merge 3 commits into from
Closed

logging - non-blocking writes to socket - v3 #2651

wants to merge 3 commits into from

Commits on Apr 5, 2017

  1. logging: don't block on socket writes 

    Writing to a unix socket can cause Suricata to block in the
packet path. This could happen if the read-endpoint of the
unix socket stays connected, but stops reading, or simply
can't read fast enough as part of its event processing.

To choose packets over events, do non-blocking socket
writes and drop the event if the write would block and
update a dropped counter.
    @jasonish
    jasonish committed Apr 5, 2017
    Configuration menu
    Copy the full SHA
    c3585db View commit details
    Browse the repository at this point in the history

  2. eve: log number of events dropped at exit

    @jasonish
    jasonish committed Apr 5, 2017
    Configuration menu
    Copy the full SHA
    cb9a806 View commit details
    Browse the repository at this point in the history

  3. logging: only do non-blocking writes if live 

    If running against a pcap there is no reason to drop events,
a blocking socket is fine here. So only do non-blocking writes
when running off a live device.
    @jasonish
    jasonish committed Apr 5, 2017
    Configuration menu
    Copy the full SHA
    f892e3a View commit details
    Browse the repository at this point in the history