mirror of https://github.com/OISF/suricata
decode: add flow memcap counter
This adds a counter indicating how many times the flow max memcap has been reached Since there is no always a reference to FlowManagerThreadData, the counter is put in DecodeThreadVars. Currently when there is no counter increase in one call of FlowGetNew because we don't have tv or dtv at the time of the call. The following is a snippet of the generated EVE entry: "flow":{"memcap":0,"spare":10000,"emerg_mode_entered":0,"emerg_mode_over":0,"tcp_reuse":0,"memuse":7085248}pull/1712/head
parent
c2704c3933
commit
769722101e
Loading…
Reference in New Issue